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PREFACE 

This document is submitted in compliance with Line Item No. 2 of the 
Data Requirements List as Type I Data, Contract NAS9-12836. The documer 
is divided into four volumes for ease of handling. The contents of 
each volume is defined as: 

Volume I; Includes sections entitled Introduction, Mission 
Envelope and Flight Dynamics which correspond to 
Sections 1.0, 2.0 and 3.0 of the Table of Contents. 
Volume II: Includes sections entitled Introduction and Shuttle 

Vehicle Systems which correspond to sections 1.0 and 

4.0 to 4.18 of the Table of Contents. 

Volume III: Includes sections entitled Introduction and Shuttle 

Vehicle Systems which correspond to sections 1.0 and 
4.19 to 4.22 of the Table of Contents. 

Volume IV: Includes sections entitled External Interfaces, Crevi 

Prodedures, Crew Station, Visual Cues and Aural 
Cues which correspond to sections 5.0, 6.0, 7.0, 

8.0 and 9.0 of the Table of Contents. 


Volume III 


Volume IV: 
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1.0 Introduction 

The objective of the Shuttle Vehicle and Mission Simulation 
Requirements report is to provide to NASA/MSC documentation of the 
requirements for faithful simulation of the Shuttle Vehicle, its 
systems, mission, operations and interfaces. To accomplish this 
objective the 'report was divided into eight topics which comprehensively 
cover the simulation requirements of the Shuttle mission and vehicle. 

The topics and their main objectives are summarized below. 

Mission Envelope - This topic covers the space and atmospheric 

missions that are envisioned for the Shuttle 
program. The characteristics of each mission 
are described by an analysis of the mission 
phases, trajectory information, timelines 
and operations for nominal and abort condi- 
tions to the extent data was available. 

Orbiter Flight Dynamics - This topic covers the flight regimes 

which the Shuttle vehicle w ill encounter in 
the accomplishment of its missions. The 
reqtri r e merit s— we r e-e st a b lished— i n the f oil owi n g 

i 

manner . j 

t 

The vehicle configurations that must be simu-| 

! 

lated for horizontal and vertical test j 

I 

flights, operational space missions, atmosphejr 


i 


missions and abort modes were defined. 
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The dynamics requirements were established 
by defining the forces and moments that will 
act on the vehicle during the entire mission 
envelope which include, propulsion, gravity, 
aerodynamic effects, payload effects, docking 
effects, staging effects, ground reactions 
and the dumping of material overboard. The 
translational equations of motion requirements 
were established by defining the vehicles, 
satellites and payloads whose state vectors 
must be calculated and by defining the co- 
ordinate systems, relative equations of 
motion and accuracy of the calculations . A 
similar analysis was performed for the rota- 
tional equations of motion. Mass property 
and ephemeris requirements were also identi- 
^ fied. 

Shuttle Vehicle Systems - The Shuttle vehicle systems required 

for simulation were identified and described. 
The descriptive data generated in this effortj 

was primarily based on the North American j 

! 

Shuttle proposal. The Shuttle vehicle and it|s 
system configuration is currently in a state 
of flux and therefore the descriptive data 
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External Interfaces 


contained in this report undoubtedly will 
become out of date as' the Shuttle program 
progresses. However, for the purposes of 
this study, the data is more than adequate 
to define simulator requirements and a base- 
line design when it is tempered with the past 
experience of Apollo and Gemini programs. A 
cross correlation between the NR definition 
of systems and LRU's and this report is shown 
in Table 1-1 for reference purposes. 

The external interfaces of the Shuttle 
vehicle were identified and a preliminary 
type interface description established. Due 
to the fact that for every external interface 
there also exists an equivalent on-board 
system, the descriptive data on the workings 
of the interfaces is contained in the Shuttle 
Vehicle Systems section of the report and 
cross references are provided in this sectior . 

i 

j 

system will not be available for many years. | 
As a result the study concentrated on identi- 
fying tasks by mission phase and crew member 
and identifying the probable interfaces be- 
tween work stations. The data used for the 
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analysis was a RTOP study by MacDonald- 
Douglas, conversations with George Franklin 
of NASA/MSC, past experience, and the re- 
quirements of the Shuttle vehicle & mission. 

Crew Station - The latest available data at the time of the 

writing of this report was used to identify 
the configuration of the Crew Station. The 
shape of the interior cabin, the location of 
the work stations and the allocation of the 
C&D panels by work station were established. 
Detailed data on the interior composition of 
the cabin is not currently available. 

However, simulation requirements were identi- 
fied based on past experience and accepted 
levels of fidelity for mission simulators. 

Visual Cues - The visual scene content was established for 

each of the mission phases. Attributes of 
the scene elements, to the extent feasible, 
were established and will be further defined 
in the SMSR report. The vehicle window con- j 

i 

figuration is not defined at this time but 
the best data available was utilized. The ! 
accelerations, velocites and displacements 
were established to the extent possible. Sonj 
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dynamics data was not available such as in 
the Abort phases of the mission. The missing 
information will be incorporated if it be- 
comes available xvhen the time frame and 
ground rules of the study or assumptions will 
be made . 

Aural Cues - The aural cues requirements associated with 

the mission and vehicle systems were identified 
and described. Detailed data on the charac- 
teristics of each sound was not available 
and probably will not be until the vehicle 
test program is in progress. This factor can 
be circumvented by specifying flexibility 
into the simulator aural cue equipment. 

This report will be updated at the end of the study based on data 
received as of January 1, 1972. 

Reference to study data sources are included in the margins and 
the text in order to facilitate update of this report. The numerical 
references are correlated with the data listing defined by Table 1-2. 
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4.0 SHUTTLE VEHICLE SYSTEMS 

The shuttle vehicle is composed of three major units: the orbiter 
vehicle, the external fuel tank, and the two 156" external solid rocket 
motors. Figure 4.0-1 gives the relative location of the total vehicle 
major components. Note in this figure the Abort SRM's are shown attached 
to the shuttle vehicle body. In Figure 4.0-2 the shuttle vehicle does not 
have the ABORT SRM's in place and is in an orbital configuration. Inserts 
and cutaways provide general location of additional components of the 
— shuttle vehicle. The payload shown is representative of one of the many 
possible configurations that may be accommodated in the shuttle payload 
bay. 


- 4.-0. 1 Rationale for Assumptions 
Not Required 

4.0.2 References . 


166 pages 3-3 and 2-105 
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4.1 ELECTRICAL POWER 

The electrical power system for the shuttle vehicle is composed of 
fuel cells, batteries, auxiliary power generators (AC power), and air 
breathing engine generators (AC power). These power sources are distributed 
throughout the vehicle as both AC and DC supply to operate electrical 
pumps, motors, valves, and avionic subsystems throughout the mission. The 
restarta.tfTe 'hydrogen-oxygen 'fuel ceTl powerplants were selected as the primary 
source for DC power. Projected life expectancy of these cells is approximate! 
5000 hours. Three of these fuel cells are provided, each having an output 
capability of 10KW at 29 volts ±5%. Heat and water generated by the fuel 
cell reaction process are input to the ECLS subsystem. 

For the launch, landing, and during some mission operations the three 
400 Hertz; 20/30 KVA; 120/208 VAC APU driven generators will provide additiona 
power for peak loads. During ferry flights the electrical power requirements 
will be supplied by four ABPS driven AC generators. 

Nickel -cadmium batteries provide the pyrotechnic and emergency 
power supply. The nickel -cadmium batteries use hermetically sealed cells to 
minimize maintenance requirements. A high-pressure safety relief vent on 
each cell provides the necessary safety for manned vehicles; however, the 
vents do not cycle under normal operating modes. 

As a pyrotechnic and emergency power supply, two nickel -cadmium secondar 
batteries are employed. Each battery has nominal power of 10 amp-hours at 
29 volts and 27.55 volts (nominal TBD% S0C at TBD° F. at 20 amps discharge. 

A separate battery subsystem is provided for contingency power to meet 
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special requirements for the Development Flight Instrumentation (DFI). 

A load analysis has indicated a requirement to supply 962 watts for a total 
duration of 2.5 hours, which assumes a 100-percent duty during high activity 
periods and a 10 percent duty cycle during low activity periods. Three Apollo 

I 

CSM silver-zinc entry batteries (40 amp-hr each) provide this power requireme 

166 Battery recharging will be accomplished by DC-DG convertors. Static 

inverters are provided for minor AC loads when startup of the APU is 
not warranted. Conversion of AC to DC will be accomplished when the fuel cell 
are inoperative. 

166 Power distribution and control is accomplished by bus networks with 

switching and control logic for protection Of buses and circuits from power 
source, bus load faults, and failures. 

166 The orbiter electrical system provides an electrical power umbilical 

compatible with the space station docking port power umbilical and is capable 
of receiving space station power for orbiter emergency orbital docked-phase 

i 

power requirements. In addition the orbiter provides a power umbilical and 

ji 

i is capable of transferring power to the payload module. No electrical power 

j 

I transfer is provided between the orbiter and booster. 

4.1.1. ELECTRICAL POWER DISTRIBUTION AND CONTROL (EPDC) 

* 

166 The orbiter EPDC is shown schematically in Figure 4,1-1 Primary 

28 vdc power is distributed from the three 10 kw fuel cells through three 
central DC distribution center near the fuel cells, to seven local distributioi 
boxes located near the load centers. There are two 3-phase, 400 cycle AC 
bus systems incorporated into the vehicle. The APU generators in the aft 
portion of the vehicle provide three independent AC power sources. The three 
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RPC - REMOTE POWER CONTROLLER ISOLID STATE) 

HU - DENOTES INTERFACING SUBSYSTEMS 
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TABLE 4 . 1.1 System Electrical Power Distribution and Control Schematic 
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TABLE 4 . 1 • 1 Equipment for EPDC 


'‘Feature 

. 'SefectetPApproach 

'’Equipment/Somponents 

Power types 
DC . 

Aero, boost and 
entry ac 
Orbit ac 

GSE 

24-30 v at load 

115/200-v, 400-Hz generator 
(MIL-STO-704A) 

115/200-v, 400 Hz central 
inverter system (CSM limits) 
115/200-v. 400-Hz 
(MIL-STD-7C4A) 

[Fuel cells, 1 150-amp transformer-rectifier, 
[10 amp-hr BalFe'rle's^ battery charger 
;Generators,* generator control unit 

CSM 1250-va 3-phase inverters 
(refurbish-reuse) 

Ac power umbilicals 

Bus redundancy 

Three redundant 

Magnetic latch, hermetic sealed power 
contactors 

Redundancy 

management 

Isolated (ac nonsynchro- 
nized-isolation maintained 
from source through load) 
Bus transfer after source 
failure 

Redundant loads powered 
from redundant buses 

Magnetic latch, hermetic sealed power 
contactors 

\ 

Load control. 

Hardwired electromechanical 

Magnetic latch, hermetically sealed RCCB’s 
RPC's, high-reliability relays 

I Power current return 

Structure, multipoint ground 
(single-point ground for 
signal circuits) 


Sequencing 

Conventional logic— with 
voting inputs and basic 
timing from GN&C computer 

Relays and solid-state logic 

Circuit sensing 
Main ac 

Dc 

Inverter 

Fault 

I Over-under voltage 1 

Over-under- frequency I 
•Overload ' 

Undervoltage, overload 
Over-under voltage, overload 
•Inverse time-current 
interruption 
Current limited, timed 
interruption 

. 

Generator control unit 

Solid-state sensors 1 
Solid-state sensors | 

RCCB's, thermal circuit breakers, (uses 

MIL-Spec solid-state RPC’s 


} Oenotes non avionics equipment; RCCB-Remote control circuit breakers; RPC-remote power controllers 
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buses are non'- synchronous and should not be tied to a common bus 
except when GSE is providing power. The APU generator has con- 
trols for governing voltage and frequency; however, there is no 
provision for synchronization of the generators . T'ne solid state 
1250 VA-3-phase invertors driven from the main DC buses do have 
. .sync hroni zat ion between phases . Note that in case of failure of 
any one unit, that the other invertors can be switched to provide 
redundant power. Inverter power is distributed from there to the 
local distribution boxes. 

166 From the local distribution boxes, power is distributed to loads 

and controlled by remote power controllers. The interface for power control 
and data with the Displays and Control (D&C) system is by Data Control 
Management Acquisition Control and Test (DCM ACT) units and data bus. As 
shown, certain basic power control and data functions are hardwired directly 
to dedicated D&C equipment. Transformer- rectifier units near the main DC 
distribution center supply DC power from generator sources during ferry 
missions, GSE AC sources for ground checkout, and space station AC sources 
for emergencies during docked periods. Two batteries supply emergency power 
control and pyrotechnic DC loads. The batteries can be recharged from fuel ' 
cell energy by a regulated charger. 

166 Redundant sequencers provide positive arming and safing of pyrotechnic 

devices and any other unilateral safety-of-flight electrical operations required 
of orbiter electrical subsystems. 

166 Interior lighting is provided in the flight deck, Avionics Equipment 

Bay, IVA tunnel, cabin, and airlock compartments. Both floodlights and 
spotlights are provided. Exterior lights are provided for rendezvous, docking. 
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and payload maneuvering during orbital flight, as well as atmospheric flight, 
landing and taxi. General operating characteristics of the EPDC is shown in 
Table 4.1-1. 

4.1.2 POWER DISTRIBUTION EQUIPMENT DESCRIPTION 
4. 1.2.1 GENERATOR CONTROL UNITS (GCU) 

166 Generator Control Units (GCU) provide voltage regulation for the AC 

generators, and control the Generator Load Contactor (GLC) to close (upon 
command from the D&C) when generator voltage and frequency are normal and 
open when voltage or frequency exceed limits (or a feeder fault or generator 
overload is sensed by the generator current transformers). The GCU will 
also provide failure indications to the DCM system for failure isolation 
to generator, GCU feeder, or GLC. 

56 The three 20/30 kva, 400-Hz generators used for orbital missions are 

sized to power the main propulsion engine accessories, the ABPS fuel boost pump: 
the ECLSS vaDor cycle machines, and other similar loads applied during ascent, 
entry, and landing. Frequency control is. in accordance with MIL-STD-704A. 
Synchronization of APU generator frequencies is not controlled. The generator 
design is a smaller model of existing spray-oil cooled units, and was designed 
for integration with APU gearbox zero-g lube system. 

4. 1.2. 2 POWER CONTACTORS 

66 Main AC and DC power source and bus tie contactors are the electro- 

mechanical type, and will have auxiliary contacts for interlock and position 
indication. DC types will include overcurrent sensing and trip in some 
applications. 

4. 1.2. 3 INVERTERS 

gg There are four inverters; single-phase units with 1250-va, 115-v 

400-Hz output rating. They are completely static, solid/state, and have 
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provisions for sensing and limiting overload current in either of two output 
terminals. Synchronization and phase relationship between units is provided 
by an internal clock oscillator in the master inverter unit for phase A, and 
120-degree lock signals between inverters connected to succeeding phases. 
Bus 1 and Bus 2 inverter sets will also be synchronized. 

4. 1.2. 4 TRANSFORMER-RECTIFIERS (TR) 


-The three transformer-rectif iers (T-R) are each rated at 28-v, 150-am| 
output and can deliver 225-amp for five minutes and 300-amp for five seconds. 

The T-R's contain no active regulator to control output voltage. The 
regulation of the transformer and rectifier over the normal load range 
provides output voltage within subsystem limits. 

4. 1.2. 5 BATTERY/ CHARGER 

A solid-state battery charger uses fuel cell energy to recharge 
the 10-amp-hour nickel cadmium batteries after partial discharge for pyrotechn- 
loads and/or emergency power control . The charger is a constant current 

type with maximum voltage cutoff control, and will sense battery temperature , 

i 

to adjust cutoff voltage. ' . j 

] 

4. 1.2. 6 REMOTE POWER CONTROLLERS (RPC) 

Two types of remote power controllers are used in the local 
power distribution boxes: solid-state and hybrid. Solid-state power controllers 

protect and control DC loads rated from 1 to 10 amp. They limit 
overload current to 150-percent RPC rating and control turn-on and 
turn-off time for transient current and voltage control. They also provide 
trip indication to D&C through the DCM system. 

Hybrid power controllers control and protect DC loads rated 
above 10 amp and AC loads. This RPC type uses solid-state sensing and control 
and electromechanical contacts for power switching. The hybrid RPC's have 
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inverse current-time overload trip characteristics, and for AC are 
in both single and three-pole types. 

166 Both solid-state and hybrid Ramote Power Controller (RPC) are 

trip-free, and are controlled by a 5-v, 10-ma signal for on and 0-v 
open circuit for off. Reset after trip is accomplished in both types 
by removing the control signal. All RPC's have fus-eable links as back 
up to the solid-state overload sensing and trip circuits, and the hybrid 
DC RPC's also have a current trip coil. 

4.1.2. 7 SEQUENCERS 

166 Sequencer units contain a sequencer bus which is armed only 

during sequence events. Dual-redundant firing relays short protechnic 
^ devices during all periods except firing. Connection is made to sequencer 

r buses on logic command from the DCM. 

4. 1.2. 8 INTERIOR LIGHTING 

166 Floodlighting is provided by fluorescent lamps and spotlighting 

by incandescent lamps. Integral D&C panel lighting is a part of D&C and is 
provided by that subsystem. 

4. 1.2. 9 EXTERIOR LIGHTING 

166 For "exterior lighting during orbit, flashing rendezvous lights are 

provided for the space station rendezvous phase. Running lights and a 
docking light are provided for stationkeeping and docking. A spotlight 
on each payload manipulator arm provides payload illumination. For atmos- 
pheric flight phases, the rendezvous light is used as an anti colli si on 
light. Other FAA lighting requirements are met by position lights and 
fuselage lights. Might landing requirements are met with three landing 
lights mounted on the landing gear. The nose-gear landing light is also 
used as a taxi light. 

4.1.2.10 FUEL CELL SYSTEM 
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166 The shuttle orbiter vehicle carries three 10 KW peak power fuel 

cells for a prime source of power during orbital missions. During ferry 
missions the fuel cells remain inactive. Figure 4.1-2 gives the expected 
fuel cell load. 

L 66 Redundant cryogenic tanks provide the gaseous 0 2 and at nominal 

pressures of 900 psia and 250 psia respectively. 

66 *N0TE: To date manufacturer/ type of fuel cell has not been 

selected, however, the two types under consideration have similar character- 
istics. 

66 The hydrogen-oxygen fuel cells are the low- temperature restartable 

type and are either the contained electrolyte Pratt and Whitney or the ion-exch<nge 
membrane type power units. The reaction conditions are 60 psia pressure 
and 200 F using a catalyst for the reaction. Refer to Figure 4.1-3. 

66 Voltage control will be achieved either by inherent characteristics 

or by voltage regulators. 

66 Controlled gas regulators will provide near equal pressures to the 

fuel cell chambers to prevent flooding and contamination. Preheaters will ( ' 

be used to precondition incomming gas flows. Purging will be accomplished 
on a fixed watt-hour usage by integration devices and controls. Separate 
purge systems are provided for both reactants. Water vapor and gaseous 
reactant will be separated either by a static separator (droplet collector) 
operating at a differential pressure caused by circulation or by wicking 
Product water is routed to the EC/LSS storage tanks or overboard disposal. 

Check valves and pressure relief regulators are provided on fuel lines and 
product lines to prevent directional flow problems. Heaters are provided 
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on all lines and ports where water products accumulate or discharge. Waste 
heat from the reactor unit is removed by circulating coolant through heat 
exchangers, or through the electrodes. Pumps, accumulators, pressure and 
temperature controls circulate the reactant and coolant and provide proper 
fluid volumes and thermal control within the power plant unit. The waste 
heat from the coolant loop is transferred to the ECLSS coolant loop or to 
freon heat exchangers during certain vehicle operating modes. 

4.1.3 ELECTRICAL POWER OPERATIONAL CHARACTERISTICS 

The interface to the electrical-power system for most power control 
and data transmission is by DCM Acquisition, Control, and Test (ACT) units. 
Central automatic power management functions are performed by the DCM central 
computer complex. Certain basic power control and data functions are hardwired 
directly to dedicated D&C equipment. 

The AC generators are driven by APU's during boost, entry, cruise, 
and landing flight phases of the orbiter mission. The generators 
are connected to isolated AC buses normally and controlled by 

1 

Generator Control Units (GCU) . ; 

The orbiter Transformer Rectifier units provide DC power from ground 
and space station AC sources and from the onboard generators during ferry 
missions. Batteries supply emergency power control and pyrotechnic DC loads. 
Orbiter batteries can be recharged from fuel cell energy. An orbiter central 
inverter system supplies AC loads which require 3 phase power during orbit 
flight phases from two redundant 3-phase AC buses, each supplied from a 
set of four single-phase inverters. . 
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166 Power feeders, protected by current limiters, feed power distribution 

boxes from the central buses. Locally, solid-state and hybrid power controlle 
control and protect load circuits, interfacing with adjacent DCM-ACT units. 
Redundant loads are connected to redundant buses. 

166 For "failure isolation, failed power sources will be isolated from the 

bus, and the bus will be connected to another power source through bus tie 
contactors. 

166 Table 4.1.2 lists the orbiter electrical power characteristics which 

are common to those in the booster. Figures 4.1-4 and 4.1-5 depict common 
| orbiter-booster electrical voltage transient envelopes. 
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- Table 4.1.2 Electrical Power Characteristics at 
- - - Load Interface - — 


- — • 'Item 

Main Bus 

Sequencer Bus 

- • — . . 

DC POWER 

• 

Voltage: Nominal 

28 

28 

— - — Steady-state limits 

24-30 

24-30 ‘ 

• “ '' • Transient limits 

See Fig. 4.1.3 

5-40 recovery in one 



second 

‘Ripple voltage 

'(•MIL- STD -704 A) 

4 p-p 

.Availability " 

'All ..flight and 

When .b.us- armed 

• ' ~ *•-*’" ■ - - * 

■ground operations 


' PoWer interruption 

Single bus - see 

See Figure 

— : 1 : ’ - - - . ------ 

■Figure Redundant 


- — — ... - .... - - - - - 

Buses - none 


Negative return 

Structure - 

Wire -single point 

. - ~ 

multipoint ground 

ground * 

Item 

Main Bus 

Inverter Bus (Orbiter) 


I 


Phases 

Voltage: Nominal 

•' Steady- state limits 


AC POWER ~ 


3, 120 degree 
±4 degree 
115/200 

See Figure 4.1.4 


- Transient limits 


Wave shape ^ 
Frequency: Steady-state 
transient 


Availability: - Ferry -missions 
Orbital missions 


See Figure —4 .1-.4-- 

Sine (MIL-STD-704A) 
400 ±20 Hz 

: MIL-STD-704A “ " 

All flight and- - -:.t; 
ground 

Boost, delta. V, entry 
cruise, landing, 
ground 


3, 120 degree 
±4 degree - - r: - - 
115/200 - 

115 +2 -4^average of 
3 phases and single 
phase ----- : r 

115 +15 -17 50 ms 
recovery 

Sine (MIL -STD -7 04 A) 
400 ±2 Hz 


AlLperiods 
All periods 


Power interruption 
Neutral return . . . 


• - -See Fig. 4.1.4- 

Structure- 

multipoint ground 


One minute 

Structure- 
multipoint ground 


6-408 


: SD 71-114-2(2) 


? 












10/20/72 


4-18 




-TSifr- CKCOKl>« - 




'Figure 4.1.3 ~DC Transient and Steady-State 
Voltage Limits 




Figure 4 * 1.4 AC Transient and Steady-State 

Voltage Limits 
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4.1.4 Functional Interfaces and Support Requirements 

4. 1.4.1 Data Control and Management (PCM) 

The EPDC interface for power control; EPDC 
data; automatic, normal and emergency power management functions; 
and data recording will be through the DCM ACT units. The ACT unit 
control interface with the RPC's will be a continuous 5-v, 10-ma 
signal for on, 0-v open circuit for off. The ACT data interface with 
RPC trip signals, power contactor position, and EPDC analog data 
signals will be a 5-v 1 -megohm input. 

4. 1.4. 2 Displays and Controls (D&C) 

The EPDC interface with D&C for normal crew display and 
control functions will be through the DCM. However, functions 
required for initial power-up (or power restoration) of DCM and 
integrated D&C will be hardwired between EPDC and D&C. Such functions 
include the application of GSE power, AC and DC bus switching, 
inverter system controls, fuel cell systems controls, and ECLSS 
electronics cooling controls. Where controls are required to be both 
manual hardwired through D&C and automatic through DCM, the circuit 
will be designed to permit D&C manual control to override the DCM 
signal. The D&C control interface with EPDC RPC's will be a 5-v, 

10-ma signal for on, 0-v grounded for off, and open circuit for 
automatic through DCM (if required). 

4. 1.4. 3 Electrical Power Generation (EPG) 

The EPDC interface with the EPG will be at the fuel cell, 

AC generator, and battery terminals. Electrical power characteristics 
at the interface will be: 
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1. • Fuel cells: 29-v ±5-percent load range of 1.5 to 10 kw 
.2. AC generators: 120/208-v, 3-phase, load range of 

0 to 30 kva, 400 ±20 Hz 

3. Batteries: 27.55-v at 20 amp discharge with a TBD% S0C 

The EPDC will nominally distribute power to the loads while 
maintaining power characteristics at the subsystem load interface as 
stated. The EPDC 6CU will regulate the~EPG ‘AC generator voltage. 

4. 1.4. 4 Electrical System Power Losses 

The EPG will provide for EPDC power distribution conversion 
and control power losses as listed: 

EQUIPMENT I POWER LOSS (watt) 


DC distribution and control 

AC distribution and control 

Inverter distribution and 
control 

Inverter 

Transformer-rectifier 

Interior lighting 

Ext^Yior lighting, payload 
manipulation 

Exterior lighting, atmospheric 
running 

Exterior lighting, landing 
and taxi 


108 w, plus 4 percent of DC load 

66 w, plus 1.3 percent of AC load 

26 w, plus 1 percent of inverter 
load 

25 percent of inverter load 
17.6 percent of DC load 
275 w maximum 
800 w maximum 

275 w maximum 

3000 w maximum 


4. 1.4. 5 Environmental Cohtrol/Life Support (ECLSS) Interface 

EPDC equipment (except wire harnesses) and lighting will be 
located in the crew compartment - electronic equipment bay, near the 
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fuel cells and near the APU's. EPDC equipment is temperature^ 
controlled by ECLSS to maintain the temperature limits listed 
below at the mounting surface while dissipating the power listed. 


EQUIPMENT 

LOCATION 

• v*t 

NO. 

REG. 

PER UNIT 
MAX. POWER 
LOSS (w) 

TEMP. 

LIMITS 

(F°) 

GCU • 

Near APU's 

3 

50 

-65, +200 

Inverter 

Electronics bay 

6 

113 

+40, +140 

Battery charger 

Electronics bay 

1 

40 

-65, +150 

Transformer 

rectifier 

Electronics bay 

3 

740 

-65, +150 

Central dc 
distribution box 

Electronics bay 

2 

60 

-65, +200 

Central ac 
distribtuion box 

Near APU's 

2 

50 

-65, +200 

Inverter ac central 
distribution box 

Electronics bay 

2 

10 

-65, +200 

Local Power 
distribution box 

Forward c rev/ 
Compartment 

2 

29 

-65, +200 


D&C panel 

2 

40 

-65, +200 


Airlock 

2 

5 

-65, +200 


Electronics bay 

2 

98 

-65, +200 

i 

j 

Near forward 
Cargo Bay 

2 

61 

-65, +200 

i 

Near Aft 
Cargo Bay 

2 

16 

-65, +200 

i 

Near APU's 

2 

165 

-65, +200 





. . ' 
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4. 1.4. 6 Power Utilization Subsystems 

The EPDC interface is at the using subsystem connector. Powe 
characteristics as listed in Paragraph 4. 1.4. 3 is supplied to the 
interface for the loads. Power control and interconnecting wiring 
for all subsystems is provided by EPDC. 

4. 1.4. 7 Support Equipment - GSE 

The interface for ground electrical power to the orbiter 
will be through an external power umbilical connector located near 

the APU's. 120/208-v, 3-phase, 400-Hz power of 60-kva maximum can | 
be furnished from the GSE to this interface. 

4. 1.4. 8 Payload 

An average of 1000-w DC (maximum 1.5 kw) power will be supplie 

• ’ i 

by the orbiter to the payload power interface umbilical ."located at j 
the forward end of the cargo bay. 

4. 1.4. 9 Space Station Interface 

An average of 500-w DC (maximum 800 w) power will be supplied 
by the orbiter to the space station interface umbilical, located at the 
airlock docking port. The space station will be capable of supplying to 
the orbiter 7-kva maximum, 115/200-v, 3-phase, 400-Hz AC power through 
each of two umbilicals located at the airlock docking port. 

4.1.5 Rationale for Assumptions 
Not required. 

” 

4.1.6 References 
166 Pages 3-85 to 3-93 

166 Page 3-157 

38 Pages 408-409 
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4.2 Mechanical Power 

Auxiliary mechanical power is used by the shuttle vehicle for hydraulic 
operation of linear and rotary actuators, electrical power generation, 
shock dampers, and pressurization of tanks. Pressurization of fuel tanks 
is discussed in each section which has a requirement for individual fuel 
supply pressurization. Hydraulic power and generation of AC power is 
accomplished by Auxiliary Power Units (APU's) or the ABPS during ferry 
operations. Refer to Figure 4.2-1. 

4.2.1 Auxiliary Power Units (APU) 

« 

Four independent 200 HP APU's provide power to a shaft driving an 
AC alternator, a lube pump, and three hydraulic pumps. The description of 
the AC alternator interface with the electrical power system is discussed 
in Paragraph 4.1.2. The lube pump supplies the APU and gearbox during 
operation. The hydraulic pumps provide the shuttle vehicle with primary 
hydraulic power for approximately 90 minutes during prelaunch, ascent, 
entry, and landing. 

Electronic controls provide for speed control, turbine inlet 
temperature control, logic for APU startup and shutdown, instrumentation, 
and malfunction protection. Automatic shutdown of an APU will occur if 
turbine speed, turbine inlet temperature, and lube oil temperature or 
pressure exceed limits. Each APU is enclosed for both heat transfer 
reduction and fire protection. Redundant fire extenguishers are provided 
for each APU. Overheat sensors are provided to the caution and warning 
system. 
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A separate pressurization subsystem and elastomeric diaphragm tank 
assembly supply the hydrazine (^t^) to each APU. Pressure modulation control 
is used to control the turbine speed and thereby frequency of the AC generator 
The combustion of hydrazine is accomplished by a thermal decomposition 
chamber. 

A period of ten minutes is required for preheating the decomposition 
chambers to ignition temperature. This period Ts'compattbTe with pre launch 
and entry timelines. Power requirements are 200 to 500 watts depending on 
the chamber configuration. While on-orbit, fuel temperature is maintained 
above 40° F using radiation heaters for fuel tanks and strip heaters for 
fuel lines. 

System cooling is provided by air coolers during prelaunch operations; 
by water boilers during boost, injection, and from start of entry to 20,000 
feet; and by air coolers below 20,000 feet, including ferry operation. Ducted 
ram air is provided in flight, and electric-driven fans are used during 
ground operations. The use of air coolers below 20,000 feet instead of 
continuous water boiler operation maintains system temperatures below 275° F. 

4.2. 1.1 Rationale for Assumptions 
Not required. 

4. 2. 1.2 References 

166. Pages 3-86 to 3-89 
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Auxiliary Power Unit and Hydraulic Pumping Subsystems 



APU Subsystem 




FIGURE 4.2-1 
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4.2.2 Hydraulic Power System 

166 The APU's drive multiple hydraulic pumps which provide supply 

redundancy. Check valves in the outlet lines of each pump prevent back 
flow to a failed pump. During atmospheric ferry flights, provision 
is made to provide hydraulic power from gear pumps on the ABES. During 
space operations when only litjht hydraulic power is required, electrical 
"AG^gecrr-pumps "wi-M^be -used. 'Refer- 'to "figure 4.2. 2-1 

166 ‘ Hydraulic power is used to drive the linear actuators of the 

thrust vector control system of both the orbital maneuvering engines 
and the main engines, retraction of the main engine nozzle, and main 
engine control valves. Hydraulic power is also used for deployment 
of the ABE and operation of the payload and ABE access doors, hydraulic 
motor and linear actuator. All landing gear functions of braking, door 
operation, steering, and gear extension/retraction are hydraulic functions. 

166 Accumulators are provided for extending or retracting the landing 

gear without flow from the system. The main gear in addition has 
accumulators for the braking system sufficient for multiple braking 

i operations even in the event of fluid loss from the main hydraulic 

unit system. 

jl 66 Circulation pumps are used to operate low power requirement 

loads, such as the payload bay doors while in orbit, and to prevent 
viscosity changes in the hydraulic fluid caused by low temperatures. 

Heat exchangers are provided to maintain the hydraulic oil within its 
operating limits. 

166 Caution and Warning displays to the crew are provided for low- 

temperature, high-temperature, low-fluid level, and low-pressure. 
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166 Distribution of power from the four independent hydraulic sub- 

systems to the various flight control and utility subsystems is illustrated 
in FIGURE 4. 2.2-1 . Use of four independent subsystems provides safe 
flight and landing after a second failure regardless of the time of the 
second occurrence. All utility functions are isolated from the pumping 
source by valves which block the trunklines after each actuation. Four 
independent hydraulic systems are powered by variable displacement pumps 
driven by separate APU's. Bootstrap type reservoirs with air/oil separators 
for self-bleeding capability ensure fluid stiffness and service life. 

166 The hydraulic subsystem is designed for operation at a nominal pressure 

of 3000 psi over a temperature range of — 40°F to +275°F. The system uses 
MIL-H-83282 synthetic hydrocarbon fluid, thereby taking advantage of its 
superior high-temperature, improved fire resistance, and reduced vacuum 
vaporization characteristics. 

166 Fluid cleanliness is maintained by 5-micron (nominal) filters 


installed downstream of all case drain manifolds, all outlet manifolds, and 
in the return port of each reservoir. Filters are also installed upstream < 
all contamination-sensitive components such as servo valves. 
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4. 2. 2.1 Rationale for Assumptions 
Not required. 

4.2. 2.2 References 

166 pages 3-86 to 3-89 
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RUDDER SINGLE CHANNEL BACKUP ELECTRO COMMAND HYORAULIC SERVO 
RUDDER THREE CHANNEL ELECTRO COMMANO HYDRAULIC SERVO 


TVC THREE CHANNEL SERVO ACTUATORS 


ABPS DOOR VALVES 
A BPS DEPLOY VALVES 

ELEVON SINGLE CHANNEL BACKUP ELECTRO COMMANO HYDRAULIC SERVO 
ELEVON THREE CHANNEL ELECTRO COMMANO HYDRAULIC SERVO 
TANDEM ELEVON SERVO ACTUATORS 


ABOVE 20 000 FT 

• WATER BOILER | 

BELOW 20.000 FT 

• AIRCOOLERS 



BRAKE VALVES 
BRAKE ACCUMULATOR 
MAIN LANDING GEAR DOWN LOCK 


.MAIN LANOING.GEAR ANO NOSE LANOtNG>GE AR,VALVE 


, TANDEM RUOOER'GLIDE BRAKE SERVO ACTUATORS 

f GLIDE BRAKE SINGLE-CHANNEL BACKUP ELECTRO COMMAND HYDRAULIC SERVO 
/GLIDE BRAKE THREE-CHANNEL ELECTRO COMMAND HYDRAULIC SERVO 
.MAIN POWER - PUMPS. RESERVOIRS. H# BOILERS ANO MISCELLANEOUS VALVES 

ABPS DOOR LATCH ACTUATOR 
ASPS STOW LATCH ACTUATOR 
ABPS STRUT ACTUATOR 
ABPS DOOR ACTUATOR 
MAIN LANDING GEAR STRUT ACTUATOR 
REOUNOANT UPLOCK ACTUATORS 


• 4 INDEPENDENT SYSTEMS 

• 3000 PSI 

• MIL H 83282 FLUIO 

• TYPE II SYSTEM 
(•40° F TO ♦ 2250FI 
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DOOR UPLOCK ACTUATOR 

NOSE LANOING GEAR STRUT 
ACTUATOR 


Orbiter Hydraulic Subsystem Arrangement 




CIRCULATING 

PUMPS 


WHEN REQUIRED 


Figure 4.2 .2-1 


Hydraulic Subsystem Configuration 
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4.3 MAIN PROPULSION SUBSYSTEM (MPS) 

The orbiter main propulsion subsystem (MPS), assisted by two booster 
solid rocket motors (SRM) during the initial phase of the ascent trajectory, 
provides the velocity increment and thrust vector control for insertion of 
the orbiter into a 50- by 100-nm orbit. MPS boost operation begins 
immediately before liftoff and terminates at orbit insertion. 

"The 'MPS consists of three liquid prope'Tlant rocket engines 
plus associated tankage, plumbing, valves, and controls. 

The engines operate on liquid oxygen and liquid hydrogen propellants contained 

in the orbiter external tank (ET), which is released following orbit insertion. 

The general arrangement of the mated MPS and ET is shown in Figure 4.3-1. 

At normal power level (NPL), each engine operates nominally at a mixture 

ratio (L0 2 /LH 2 ) of 6.0:1 and a chamber pressure of 3,000 psia to produce a 

vacuum thrust of 470,000 pounds with a fixed nozzle area ratio of 80:1. Nominal 

vacuum specific impulse (I ) for a single engine operating under these condi tioi 

sp 

is 455.2 seconds. Table 4.3-1 lists the total MPS propellant inventory for 
a 40,000 pound payload polar orbit. The same propellant loading will be used 
for reduced mission requirements or lighter payloads; however, in these cases 
the trajectory will be flown on a nonoptimum energy basis. 

A schematic diagram of the integrated MPS and ET is presented in 
Figure 4.3-2. The ET contains three fuel and two oxidizer fluid lines interfacii 
with the orbiter at self-sealing disconnects on the bottom side of the orbiter 
aft fuselage. The three fuel disconnects are clustered on the left side mounted 
on a common carrier plate, and the two oxidizer disconnects are mounted on a 
similar carrier plate on the right side. The vehicle carrier plates are located 
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FIGURE 4.3-1 


MAIN PROPULSION SUBSYSTEM 

















10/20/72 


4-33 


TABLE 4.3-1 

ORBITER PROPELLANT INVENTORY 


Item 

LH 2 (lb) 

L0 2 (lb) 

Total 

As.c.ent propellant (nominal) 

241,428 

1,448,572 

1,690,000 

\% aV performance reserve 

1,011 

6,064 

7,075 

Additional FPR (no PU) 

143 

857 

1,000 

Abort reserve (Polar Orbit) 

1,143 

6,857 

8,000 

Residuals 




Bias 

1,500 

- 

1,500 

Pressurant 

1,375 

3,370 

4,745 

Tanks and lines 

889 

778 

1,667 

Engines 

75 

945 

' 1,020 — 

Total Residuals 

3,839 

5,093 

8,932 

Total propellant at liftoff 

247,564 

1,467,443 

1,715,007 

Pre-liftoff use 

250 

2,130 

2,380 

Total propellant tanked 

247,814 

1,469,573 

1,717,387 
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166 inside the vehicle moldline and are covered by flush closure doors following 
tank jettison to provide protection from heating during entry. The tank vent 
line disconnects each contain an integral safety relief valve that precludes tan 
overpressure when the tank-mounted disconnect is not engaged with the orbiter- . 
mounted half. All other MPS fluid control valves, including tank vent and tank 
fill and drain valves, are located in the orbiter to minimize ET throwaway costs 
Saturn S-II-type fluid line vibration damping mounts will be provided on the tan 
mounted lines at critical locations. All tank-mounted fluid lines are designed 
for single mission (minimum weight and cost) application, whereas the orbiter- 
mounted fluid lines are designed for maximum reusability and employ vacuum 
jacket insulation. The installation arrangement of all orbiter-mounted fuel 
and oxidizer lines is portrayed in Figure 4.3-3. 

166 The MPS fluid valves employ the same design concepts as the valves 

developed for the Saturn V program except for upgrading required to achieve the 
extended life (reusability) requirements of the orbiter. A 4,000 psi helium 
storage system with 750 psig regulation capability is provided in the orbiter 
for valve actuation and engine helium requirements. The schematic arrangement 
of the orbiter MPS helium system is included in Figure 4.3-3. 

66 Propellant servicing is accomplished through fuel and oxidizer disconnects 

of eight-inch diameter located on the upper shoulder of the orbiter aft fuselage 
on the opposite sides of the vertical stabilizer. The eight-inch diameter 
fill and drain lines each contain two shutoff valves in series to assure closure 
at liftoff. L0 2 geysering in the ET feedline manifold is prevented during prela 
operations by convection-induced flow of L0 2 from the insulated 17-inch diameter 
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'MAIN ENGINES l3) 
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FIGURE 4.3-3 

MAIN PROPULSION SUBSYSTEM INSTALLATION 
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manifold to the 4-inch diameter uninsulated antigeysering duct. Propellant 
loading is controlled by an orbi ter-mounted signal conditioning unit supplying 
the ground loading equipment with signals from the ET-mounted warm wire point 
sensors. Differential pressure gauges installed in the orbi ter between the 
propellant feed and vent lines provide intermediate loading level data between 
'-“pO'f nt^errsors - 4 or -both -the- 4uel >*a«id-»ox.idizer- subsystems.. 

Predicted propellant loading tolerances are within ±0.6 percent for 
L0 2 and ±0.7 percent for LH 2 . Tank manufacturing volumetric tolerances and 
repeatability of point sensor locations will be controlled to achieve the 
required f 1 i ght-to-f 1 i ght propellant loading accuracy. The propellant gauging 
system will be used for controlling tank loading operations and provides 
level indication. The in-flight engine mixture ratio control is preprogrammed 
before flight to a fixed value in the range of 5.8 to 6.2. The preprogrammed 
value for each flight will be based on predicted engine performance and predicte 
loading system tolerances to minimize the quantity of unused L0 2 . 

Incorporation of an LH 2 bias (1,500 pounds) to assure depletion 

of the heavier L0 2 propellant is effective in reducing the magnitude of the 

residual propellant mass. 

The following functions are provided to assure satisfactory engine start: 

1. Delivery of subcooled propellants to each engine inlet (3 Ib/sec 
L0 2 , 1 Ib/sec LH 2 ) to chill the engine to prescribed levels. This 
operation will start 15 minutes before engine start and terminates 
coincidently with engine start command. 

2. Ground prepressurization of tank ullage with helium (L0 2 at 20 to 22 

psia, LH 2 at 35 to 37 psia). This operation will be completed 
approximately 60 seconds before liftoff. 
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166 Subcooled L0 2 is maintained at the engine inlets by overboard bleed 

from the feedlines through the engines to ground disposal. During overboard 
bleed, 1_0 2 topping flow will be limited to a maximum temperature of 166° R 
to assure the presence of adequately subcooled propellant at the engine inlet. 

A comparable LH 2 overboard preconditioning system is not used because of the 
excessive pressure loss through the engines. Subcooled LH 2 is delivered to 
' 'the engine 'inlets 'by e'lectric-driven pumps which discharge conditioning flow 
downstream of closed prevalves through the engines and to the LH 2 tank via 
a recirculation manifold. During LH 2 recirculation, LH 2 topping flow is 
diverted to the recirculation return manifold to preclude warm LH 2 entering 
the pumps. 

166 After completion of the engine conditioning cycle, the vehicle liftoff 

sequence begins by commanding engine start to NPL. When all three engines 
reach 50 percent power level and automatic self-check of engine operation is 
satisfactorily completed, ignition of the booster SRM occurs. When main engine 
thrust reaches approximately 90 percent, the vehicle thrust-to-weight ratio 
exceeds 1.0, and liftoff occurs. Throttling of engine thrust below 100 percent 
is commanded during orbiter ascent to limit vehicle acceleration to 3g. An 
emergency poweMevel (EPL) of 109 percent may be commanded on the operating 
engines if premature thrust decay or engine shutdown is encountered on any of 
the three engines. 

166 Tank prepressurization and hydrostatic head provide the required net 

positive suction pressure (NPSP) to the engine pump inlets during the starting 
transient. Following engine thrust buildup, tank ullage pressure is maintained 
by vaporized propellant pressurant extracted from the engines. An engine-suppli 
\ on-off control valve (controlled by redundant pressure switches sensing tank 
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166 ullage pressure) in parallel with a bypass orifice is used for in-flight tank 
pressure control. Predicted tank pressurization performance is shown in 
Figure 4.3-4. 


166 The gimbal actuators and the engine control systems for the three engines 

176 are supplied with hydraulic pressure from four redundant orbiter vehicle- 

mounted APU-driven hydraulic systems. Thrust vector control during boost is 
attained by gimbaling the MRS engines to the maximum pitch and yaw deflections 
of ±11 degrees. The engines are mounted in the orbiter aft fuselage in a 
triangular pattern with an angle of 6 degrees between the upper and lower engine 
centerlines in the pitch plane. The lower engines are installed with their 
null position canted inboard 3.5 degrees in the yaw plane; however, all engines 
are fired with parallel thrust vector alignment in the yaw plane. The engine 
spacing of 104 inches in yaw and 100 inches in pitch allows adequate clearance 
for maximum gimbal deflection on the two remaining engines after any one engine 
has failed in its null position. The gimbal actuators are mechanized to drive 
to a null position if two hydraulic systems are lost, if two hard-over servo 
valve failures occur, or if two electrical signals are lost. The hydromechanica 
logic circuit within the actuator assembly senses these failures and diverts 
the remaining^taydraulic pressure supply to drive the actuator to the null 
position. 

166 MPS engine control and data signals are processed through an engine 

42 interface unit. The unit converts all engine control inputs (GN&C and manual) 

to be compatible with the engine controller serial digital data system. Engine 
serial data output is also appropriately converted for use by vehicle computer 
systems and for dedicated displays. Engine data input to the PCM recorder and 
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to telemetry will be transmitted as direct data output through separate engine 
instrumentation connectors per the vehicle/engine IGD. The engine interface 
unit is further described in Section 4.3.2 

166 A pogo suppression accumulator will be incorporated in each L0 2 propellant 

feedline at the engine inlet. 

166 Engine cutoff will normally be provided by a signal from the Guidance, 

Navigation, and Control (GN&C) subsystem when orbit injection velocity is 
attained. The Flight Performance Reserve (FPR) propellant (Table 4.3-1) 

, provides a 317 foot per second (1 percent) ideal delta velocity margin to assure 

j 

orbit injection. In those missions where the FPR is expended, engine cutoff 
i will be initiated by an L0 2 depletion signal from a cluster of five point sensors 

located in the orbiter L0 2 feed manifold. In the event an off-nominal operation 
condition results in LH 2 depletion, a cluster of five point sensors located in 
the bottom of the LH 2 tank provides an engine cutoff signal to preclude engine 
damage after shutdown. 

166 Propellant dumping and depressurization of the tanks to 5 to 15 psi before 

j tank release will be manually controlled. Dumping of residual liquids and 

venting of residual gases will be accomplished through overboard fuel and oxi direr 

dump lines whfoh discharge aft of the vehicle. Liquid propellant also will be 

"j U 

I dumped through the engines concurrent with dump system operation to provide 

sufficient thrust to settle the propellants remaining in the tanks. The total 
velocity increments introducted by dumping will be limited to 30 ft/sec. L0 2 
dumping will be initiated first followed by LH 2 dumping. GH 2 and G0 2 will be 
vented concurrently through the dump lines. , 
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Propellant dumping through the engine will be a crew-controlled operation 
starting five seconds after main engine shutdown. Dumping will be initiated by 
opening the engine main valves and the vehicle prevalves. LH 2 and L0 2 will be 
dumped through both engines. The thrust obtained from dumping will retain 
propellants in the aft end of the propellant tanks and in the feed system. Dump 
cutoff control will be accomplished manually. 

A short period after orb'iter propellant dumping, the boi 'Toff vent system 
is activated by opening the shutoff valves. Boiloff is vented overboard to 
maintain the ullage pressure within the 25.5- to 27.5-psia range. The redundant 
shutoff valve in series with the primary vent valve is left in the open position 
to permit emergency operation of the vent valve in the event of excess evaporat: on 
resulting from residual liquid splashing on hot structure. This redundant 
valve may be closed later in the mission when all of the residual liquid has 
been evaporated and/or the tank pressure decays at a level lower than the operatirg 
band of the boiloff vent system. The flow from the boiloff vent system is 
directed to the nonpropulsive vents. 

Immediately following propellant dumping the engines are purged with 
helium, and the oxygen and hydrogen prevalves are closed. The engine main 
valves, closed in series with the vehicle valves, provide a double seal against 
tank leakage. 

The AC electrical power and the hydraulic supply to the engines is discontiruei 
two minutes after engine shutdown by stopping the APU and activating the cutoff 
circuits. At a convenient time following engine cutoff, all electrical power 
is removed from the engine interface to prevent overheating the engine control unt. 

The main engine helium supply valve will also be closed if engine helium 
leakage continues after engine shutdown. 
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Figure 4.3-2 illustrates MPS controls and dedicated displays for critical 
performance parameters. Pilot override control capability is provided for 
critical MPS functions, e.g., engine shutdown and thrust level. 

166 4.3.1 Engine 

42 The orbiter main engine is a pump-fed, high chamber pressure engine 

utilizing a staged combustion concept and liquid hydrogen/liquid oxygen 
propellants. The 3,000-psi chamber pressure engine provides a vacuum thrust 
of 470,000 pounds with a nozzle expansion ratio of 80:1 and operates at an 
average propellant mixture ratio of 6:1. 

166 The major components of the engine assembly consist of a main 

42 chamber, nozzle, preburner, fuel and oxidizer turbopumps, and fixed low- 

pressure fuel and oxidizer boost pumps. Other components include an engine 
control unit, oxygen pressurant heat exchanger, fuel and oxidizer shutoff and 
control valves, a thrust mount, and a gimbal bearing block. Provisions also 
are included for a gaseous hydrogen pressurant bleed, fluid and electrical 
disconnect panels, and attachments for the TVC gimbal actuators. 

166 During engine operation, propellants flow through the turbopumps, where 

42 the propellants are pumped to high pressure for injection into the preburner and 
main combustion chamber. Prior to injection, the liquid hydrogen is used to 
cool the thrust chamber and preburner jackets. The preburner operates with 
propellants at a mixture ratio of approximately 1:1 to provide relatively cool 
fuel-rich combustion gases to drive the turbopumps. The fuel-rich turbine exhausj 
gases are injected into the main chamber with additional liquid oxygen to 
support main thrust chamber combustion. 
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4.3.2 Control /Morn' tor System i 

The control for engine start, main-stage, and shutdown is performed 
by sensing and monitoring engine performance, an electronic controller computes 
commands to modulate and sequence the values, and the integral spark ignition 
system. Refer to Figure 4. 3. 2-1. The engine monitoring function is provided ; 

to ensure the vehicle that the engine is functioning properly and to collect | 

I 

engine data for vehicle recording and post-flight engine maintenance analysis. 

The sensors provide the engine data to the controller and vehicle ’ 

for control, checkout and maintenance, and condition monitoring. Fifty- two ; 

engine parameters consisting of pressure, temperature, propellant volumetric j 
flow, turbopump shaft speed, vibration, and position are measured. The sensor 

t 

signal conditioning and analog-to-digital conversion electronics is located in 
the controller. 

The controller performs the computations for engine control and sequencing 

I 

checkout, and monitoring. The computations are performed by digital computers 
within the controller assembly. The sensor signal conditioning and analog-to- 
digital conversion electronics are time shared among the sensors by multiplexing 
within the controller. The controller interfaces with the vehicle data bus, 
accepts and validates vehicle commands, and, with sensor data, computes propella 
valve actuator commands for engine control. Controller output electronic 
circuitry transmits commands for positioning the valve actuators, switching 
hydraulic and pneumatic solenoid valves, and controlling spark ignition. 


ni 
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FIGURE 4. 3. 2-1 


ENGINE CONTROL AND MONITOR 
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4. 3. 2.1 Engine Thrust/Mixture Ratio j 

To enable control of variable thrust and mixture ratio level, 
the system uses a simple two valve control. The control points selected have 
capability to fully control the engine thrust and mixture ratio over the full 
range of required engine operating conditions. The control modulates the areas 
of the oxidizer preburner oxidizer valve and the fuel preburner oxidizer valve 
-to -achieve 'independently the proper balance of propellant flows for thrust 
and mixture ratio control. 

The control /monitor accepts data in flight and uses the data in the 
controller to compute the modulated control valve settings required to achieve 
vehicle commanded thrust and mixture ratio. This is achieved by the controller 
accepting vehicle thrust and mixture ratio commands and comparing them with 
monitored thrust and mixture ratio to determine a thrust and mixture ratio 
error. The thrust and mixture ratio errors determine the directions to change 
the two modulated control valve areas. The controller recomputes valve areas 
50 times per second (every 20 msec). Each time the valve areas are adjusted 
the controller monitors engine performance and recomputes the error between 
vehicle commanded performance and engine montiroed performance. When the 
error in performance reaches allowable limits the controller maintains the valve 
at those areas which achieved the desired level of performance. The process of 
comparing commanded performance and monitored performance and adjusting control 
valve setting is a closed loop control system. 

Two performance control loops. and one limit control loop are used in 
the engine control. Engine thrust is computed (as a percent of vacuum normal 
power level) in the controller from sensed main combustion chamber pressure and 
corrected for mixture ratio (and dump coolant on the orbiter). The vehicle 
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commanded thrust is compared with the computed thrust to obtain an error signal. 
The thrust error signal is used to compute an area command for both the oxidizer 
preburner oxidizer valve and fuel preburner oxidizer valve to drive the thrust 
error to an allowable value. 

Engine mixture ratio is computed in the controller from sensed 
.propellant volumetric flows and corrected by propellant density computed from 
sensed propellant pressure and temperature. The vehicle commanded mixture ratio 
is compared with the computed mixture ratio to obtain an error signal. The 
mixture ratio error is used to compute a correction to position 
the fuel preburner oxidizer valve, which also drives the mixture ratio error 
to an allowable value. 

Repeated computations of the thrust and mixture ratio control result 
in thrust and mixture ratio being controlled to within ±5,920 pounds (26,333.3 
newtons) thrust and ±0.82 percent mixture ratio precision which is below the 
requirement of ±7,500 pounds (33,361.5 newtons) and ± 1 percent. 

Preburner temperature limiting control is provided for protection 
of the turbine power system from overtemperature. The preburner limit control 
functions by the controller computing an override command for the thrust control 
loop to decrease thrust whenever a sensed preburner temperature rapidly 
approaches or exceeds 2,200 R (1,222.2 K). The limit control normally affects 
system operation only during maximum thrust rate transients. As the preburner 
temperature stabilizes below 2,200 R (1,222.2 K), the temperature limit override 
is reduced, allowing control to revert to the thrust control loop, and the desir 
mainstage level is attained. This control logic aids in maintaining long- 
life operation of the high-pressure turbopumps. 
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Closed-loop control is used to achieve repeatability of thrust buildupj 
to full mainstage power from a low power level (10 percent NPL) during start. 

For engine start the initial control valve sequences produce a low power level 
prior to thrust buildup. The same closed-loop control valves used for main- 
stage are used for thrust buildup control. Closed-loop mixture ratio control 
is initiated when thrust buildup to mainstage is completed. 

In addition to the two valves used in closed-loop performance control, 
three other sequenced or scheduled valves control propellant flow during engine 
operation. These are: 

1. The main oxidizer valve which is timed-positioned scheduled 
during startup and shutdown. 

2. The main fuel valve, which is sequenced open and closed during 
startup and shutdown. 

3. The combustion chamber coolant valve, which is scheduled with 
thrust level to optimize chamber cooling. 

Engine shutdown can be initiated from any power level, during transien 
of steady-state operation. It is accomplished by reducing thrust under closed- 
loop control at a rate of 4,800 pounds (21,351.4 newtons) per 10 msec. After 
a low thrust level has been attained, propellant valves are sequenced closed 
for a fuel -rich shutdown. Shutdown performance and repeatability meet require- 
ments by use of closed-loop control during a major portion of the transient. 

4. 3. 2. 2 Engine Monitoring 

Vehicle and engine protection is ensured by engine condition monitoring 
performed by the system. Selected engine parameters are sensed and monitored 
by the controller. Controller digital computer programs compare the parameters 
against limits stored in memory. If an engine limit is exceeded and if the 
vehicle limit control enable command has been invoked by the vehicle, the control 
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shuts the engine down. The vehicle also has a limit control inhibit command 
available to prevent against engine shutdown during critical periods of engine 
operation. This is done because the controller has no information with respect 
to the condition of the other booster engines, and it may be necessary to 
operate an engine above limits for a short time to ensure vehicle safety. 

Parameters monitored for limit shutdown are fuel preburner over 
temperature, oxidizer preburner over- temperature, high-pressure fuel turbopump 
shaft overspeed, high-pressure oxidizer turbopump shaft over-speed, combustion 
chamber (high and low) pressure, and oxidizer heat exchanger failure. 

If the safe limits stored in the controller memory are exceeded 
the controller automatically initiates a normal shutdown. 

4.3. 2.3 SSME CONTROLLER DATA FLOW 

All data flow for the SSME (Figure 4. 3. 2. 3-1) passes through the 
controller. 

Data flow between the engine and vehicle consists of operational 
commands and data requests from the vehicle to the engine and data transmission 
from the engine to the vehicle. All vehicle data to the engine are received 
from the vehicle/engine data bus interface unit. The controller digital compute 
interface electronics route the data to or from the controller digital computers 
Data flow in either direction is under vehicle control. 

Included in the engine-to-vehicle*data flow is engine status, other 
operational parameters, and maintenance data. The engine status includes engine 
operational phase, mode of operation, and self-test status. The operational 
parameters include actual thrust and mixture ratio. The data are transmitted iri 
blocks of digital words at a maximum rate of 25 blocks of data per second and 
a maximum data bit rate of 10,000 bits/second. I 
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FIGURE 4. 3. 2. 3-1 


SSME DATA FLOW 








F. 398-8- 


DATE 10/20/72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE NO. 4-50 

REV. 

BINGHAMTON. NEW YORK 

REP. NO. 


Sensor data from 67 sensor assemblies (93 signals with redundant 
elements) for the control and monitor functions are sampled, signal conditioned, 
multiplexed, and converted from analog to digital form in the input electronics 
every 20 msec. These sensor data are routed by the digital computer interface 
electronics to the digital computers. During checkout, commands from the digita 
computer flow back through the digital computer interface electronics unit 
to activate sensor calibration circuits in the input electronics. 

Data flow for sequencing the engine and controlling actuation devices 

is originated in the digital computers. Commands to initiate spark ignition, 

control solenoid valves, and modulate positions of valve actuators are computed 

in the digital computers. The digital interface electronics steer the data to 

the output electronics. The output electronics perform the digital-to-analog 

conversion and power amplification, and interface with the specific controlled 

devices. The commands are updated every 20 msec. 

4.3.3 SSME Operation Details 

4.3.3. 1 SSME Sequence Schedule ; 

4.3.3. 1.1 Engine Start 

Engine start operation is accomplished in two phases. The first 
fhase of the start is the open-loop start normalization phase. The second 
phase is the closed-loop thrust buildup phase. Engine start to NPL is accomplisfed 
within 3.5 seconds. Simplicity and reliability of engine start control is 1 

obtained by accomplishing the start functions with the same control elements usee 
for mainstage control and by establishing engine operation at a low power level 
prior to thrust buildup. Repeatability of thrust buildup is accomplished by 
bringing the system to full power under closed-loop control. 

The start sequence (Figure 4. 3. 3-1) is initiated by opening the main 
fuel valve to provide priming of the engine fuel system and to establish fuel fir 
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with tank-head pressure. The main fuel valve is full open in 0.4 second. Spark 
igniter operation is initiated in all units and maintained for 3.5 seconds into 
the start. 

Opening of the three oxidizer valves is initiated 100 milliseconds 
after start. The main oxidizer valve ramps to a 55 ±2 per cent open position 
at a rate of 100 percent/sec. The fuel preburner oxidizer and oxidizer preburner 
<oxid'i'Zer 'va’lves open 'to their initial opening of 2 percent of full area. 

Preburner ignition and main combustion chamber ignition follow in approximately 
100 milliseconds. The four turbopumps are powered at a very low level by heated 
hydrogen until 0.5 second after start initiation. At 0.5 second, the fuel pre- 
burner oxidizer valve ramps to 12 percent open and thrust builds up to approximately ! 
10 percent of NPL. This phase of engine start sequence is used to achieve 
approximately 10 percent NPL thrust to accommodate variations in the start 
transients due to tank pressures, booster-orbiter differences, environmental 
temperatures, etc. The positions of all valves are set to establish engine power 
at approximately 10 percent of NPL with an engine mixture ratio in the range of 

1.0 to 2.0. Partial opening of the main oxidizer valve results in less oxidizer 
flow acceleration prior to main chamber priming, tends to increase preburner power 
level and temperature while at the low engine power levels, and reduces the 
pressure transients when the main chamber primes. When the main oxidizer injector 
primes, a thrust level of approximately 10 percent NPL is attained. During 

this phase when thrust is below 15 percent, the maximum thrust rate is approximately 

13.000 pounds (57,826.6 newtons) per 10 msec period. This rate is the highest 
that has been experienced in simulation runs below 15 percent of NPL. 
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The flexibility of dual preburners allows fuel preburner flow buildup 
to occur prior to oxidizer preburner flow buildup to ensure a fuel -rich start 
and to maintain a satisfactory fuel pump flow coefficient with the largest pump 
inlet pressure unbalance [(20 psia (13,79N/cm 2 )fuel , 225 psia (155.13 N/cm 2 ) 
oxidizer] that can exist. 

The second phase of the start is initiated at 1.7 seconds by activating 
closed-loop thrust control. The thrust control is allowed to stabilize at 10 
percent of NPL of 0.30 second. The thrust control compensation is proportional 
at this time. Integral compensation is added in proportion to thrust level 
until MPL is attained, when integral gain is at the nominal MPL mainstage 
value. At 2.0 seconds, the main oxidizer valve is ramped open and the thrust 
command ramp initiated. The thrust command ramp is set at 4,800 pounds 
(21,351.4 newtons) per 10 millisecond rate to ensure the fastest practical 
thrust rate increase without exceeding the 7,000-pounds (31,137.4 newtons) per 
10 millisecond maximum allowable rate. During start, open-loop mixture ratio con - 
is accomplished by positioning the fuel preburner oxidizer valve from a thrust 
controller cross-feed signal. The cross-feed gain is selected so that the engine 
mixture ratio is in a high specific impulse range (2.0 to 4.0 main combustor 
mixture ratio) during a major portion of the thrust buildup and is at approximate' 
the nominal value of 6.0 at mixture ratio control activation. This maximizes 
the specific impulse during the start transient and minimizes closed-loop 
control activation transients. 

At 3.25 seconds, closed-loop mixture ratio control is activated. At 
that time: (1) cross-feed gain from thrust to mixture ratio control is changed 

to the mainstage value, and (2) the mixture ratio control compensation output 
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is initialized for a smooth transition from scheduled to closed- loop mixture 
ratio control. At 3.5 seconds, thrust and mixture ratio are within mainstage 
tolerance. 

4. 3. 3. 1.2 Engine Shutdown 

Engine shutdown can be initiated from any power level during transient 
or steady-state operation. Shutdown repeatability is obtained with closed- 
loop control. Shutdown may be initiated by vehicle command or controller- 
generated limit shutdown signal. 

Engine shutdown is accomplished in two operating phases, illustrated 
in Figure 4.3. 3-2 . The initial phase is a controlled thrust rate of 4,800 

pounds (21,351 newtons) decrease per 10-msec period. This effective rate 
minimizes both the shutdown time and shutdown impulse while keeping the 
transient thrust change rate within the 7,000 pounds (31,137 newtons) per 
10-msec maximum allowable thrust decay rate. The closed-loop shutdown is 
predictable and repeatable from any mainstage level. Closed-loop mixture ratio 
control is active during this phase of shutdown. 

The second phase of the shutdown sequence is initiated when the 
thrust reference decreases below MPL and sequenced closing of the propellant 
valves is initiated. At the start of this phase, a 0.85 second main oxidizer 
valve closing ramp is initiated. At 0.3 second into the phase, the oxidizer 
preburner oxidizer valve and the fuel preburner oxidizer valve are commanded 
full closed at 150 percent/sec. At 0.65 second into the phase, main fuel valve 
closing is initiated. The combustor coolant valve is ramped close when thrust 
decreases below MPL. All oxidizer valves are closed before the main fuel valve, 
ensuring fuel-rich shutdown. Total impulse and propellant consumed below MPS are 
more than 100,000 pound-sec (444,820 newton-sec) and less than 480 pounds (216,7 
kilograms), respectively. ' 
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CLOSED-LOOP THRUST 
BUILDUP 


MAINS CAGE 


VALVE POSITION 


0 - FULLY OPEN 
C - CLOSED 


r - START TO EPL 
_ START TO NPL 


KAIN FUEL 




HAIM OXIDIZER 


FUEL. PRE3URNER OXIOIZER 


OXIDIZER PRES'JRNER OXIOIZER 
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THRUST RISE RATE 


/ 

A— START to m?l 
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" 




SEQUENCE SIGNALS 

IGNITION OF ALL AS I * OPEN-SEAL FLOW & 
THROUGH ALL OXIDIZER VALVES 


TURBINES POWERED BY HEATED 
- -HYDROGEN ONLY 


CIZJ 


FUEL PRE3URSER OXIOIZER 
VALVE INITIAL POSITION 


CLOSED-LOOP THRUST CONTROL 
INITIATED (PROPORTIONAL) 


TRANSITION TO NCR.-AL MAIN STAGE 
THRUST CONTROL COMPENSATION COMPLETED 


CLOSED-LOOP .MIXTURE RATIO 
CONTROL INITIATED 


TIME FROM START SIGNAL. SECONDS 


FIGURE 4. 3. 3-1 


ENGINE START SEQUENCE 
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•‘VALVE -POStT-ICN 
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SEQUENCE SICNALS 


ENGINE SHUTDOWN SIGNALS A INITIATE 4300 IB/tC MILL I SECONO RAMP 


TKR’JST COMMAND REACHES H?L "A ,N,T,AT£ M,H OXIDIZER VALVE 

0.8s SECOND CLOSING RAMP 


START VALVE CLOSING SEQUENCE 


A STEP COMMAND 30TH PRE3URNERS VALVES AND COOLANT 
- VALVE CLOSED . 



FIGURE 4. 3. 3-2 
ENGINE SHUTDOWN SEQUENCE 
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The main fuel valve is full closed 1.05 seconds after thrust 
reference reaches MPL and all propellant flow has stopped except for residuals 
downstream of the main valves. Impulse from residuals will be approximately 
15,000 lb/sec (66,723 newton-sec) and will have a duration of about 0.5 
second. 

4. 3. 3. 2 SSME Flight Operations Monitoring 

Continuous In-Flight Test 

During engine operation, the controller continually performs a built- 
in test of the controller, sensors, and actuating devices. A summary of these 
built-in tests is provided in Table 4. 3. 3. 2-1. During the start and shutdown 
sequences, the controller monitors the opening and closing sequencing of the 
propellant valve actuators and verifies that the power level of the engine' increa 
and decreases in accordance with programmed limits. It also verifies proper 
timing of the ignition sequence. 

As part of the shutdown sequence, the controller verifies that all 
control devices have been returned to a fail-safe condition and that the engine 
is safely shut down. Position sensors are monitored to verify retraction 
of the orbiter's extendible nozzle. The engine shutdown status is made 
available to the vehicle. 

Additional monitoring during flight operation falls into five 
categories: 

1. Performance Monitoring - Monitoring of engine thrust and mixture 
ratio to verify proper response to vehicle commands and to provide 
engine performance status to the vehicle. 

2. Limit Control Override - Monitoring of preburner temperatures. 

If a temperature limit is exceeded, the controller throttles the 
engine power level to reduce temperature below the limit if limit 
control is enabled from the vehicle. 
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3. Limit Control Shutdown - Detection of preburner over temperature, 
turbopump overspeed, main combustion chamber overpressure and 
underpressure and oxidizer heat exchanger failure. The controller 
uses the limit control shutdown measurements to determine if the 
engine has exceeded a safe operating limit or shutdown condition. 
J.f <any~*of -these ^parameters ^exceed a .safe, opera.ti ng 1 imi t, the 
engine is shut down provided the limit control is enabled from 
the vehicle. 

The preburner temperature limits used in limit control shutdown 
are higher than those used in limit control override. Table 
4. 3. 3. 2-2 summarizes the measurements and the limits which determi 
if the engine should be shut down. 

4. Position Monitoring - Monitoring of actuator/valve positions 
for verification of proper operating sequences and interlocks. ! 

5. Data Transmission - Transmitting engine status and performance 
data to the vehicle for recording of engine trends. 

|2 Propellant dumping through the engine may be sequenced during the post 

shutdown phase. The propellant valves are positioned by commands from the vehicl 
The controller provides interlock logic to ensure oxidizer dumping prior to 
fuel dumping and to prevent both fuel and oxidizer valves from being open 
at the same time. 


) 
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TEST ITEM 

SUMMARY OF TEST 

GROUND 

OPERATIONS 

CHECKOUT 

FLIGHT 

OPERATIONS 

MONITORING 

CONTROLLER 




DIGITAL COMPUTER 

SAMPLE PROBLEM TESTS PROCESSOR AHO MEMORY 

X 

X 


MEMORY PARITY CHECK 0N EACH READ OPERATION 

X 

X 


WATCHDOG TIMERS VERIFY PROPER SEQUENCING THROUGH 
DIGITAL PROGRAM 

X 

X 

• 

MEMORY 'SUM CHECKS 

X 


computer interpace.. 

ELECTRONICS. 

CIRCULATE OATA FROM MEMORY THROUGH DATA BUS INTERFACE 
ELECTRONICS BACK INTO MEMORY 

X 

X 


SIMULATE WATCHOOC TIMER OPERATION BY ALTERING DECAY 
TIME 

X 

X 

INPUT ELECTRONICS 

INPUT REFERENCE VOLTAGES TO CHECK ANALOG TO DIGITAL 
CONVERTER 

X 

X . 


CHECK MULTIPLEXER SWITCHES WITH SENSOR TESTS 

X 

X 

OUTPUT ELECTRONICS 

■ 

INDIVIDUAL POWER SUPPLY VOLTAGES VERIFIED BY 
REGULATOR MONITOR CIRCUIT 

X 

X 

SENSORS 

STIMULATE SENSORS BY BRIDGE SHUNTING OR INOUCTIVE/ 
CAPACITIVE COUPLING OF TEST SIGNALS 

X 



CHECK SENSOR SIGNALS FOR REASONABLENESS 

X 

X 


PERFORM COMPARISON TESTS OH REDUNDANT SENSORS 


X 

ACTUATORS 

ISSUE STEP COMMANDS ANO CHECK ACTUATOR POSITION AND 
RATE OF TRAVEL 

X 



COMPARE SERVOVALVE OUTPUTS WITH ELECTRONIC MODEL 

X 

X 


COMPARE ACTUATOR POSITION FEEDBACK SIGNALS WITH 
ACTUATOR COMMANOS 

X 

X 

ON/OFF VALVES 

ENERGIZE ON/OFF VALVES AND VERIFY SWITCHING BY 
POSITION ANO/OR PRESSURE MEASUREMENTS 

X 



MONITOR NORMAL SWITCHING OPERATIONS BY POSITION 
AND/OR PRESSURE MEASUREMENTS 

X 

X 

SPARK IGNITERS 

ENERGIZE AND MONITOR SPARK RATE AND VOLTAGE 

X 



MONITOR NORMAL OPERATION 


X 


TABLE 4. 3. 3. 2-1 


BUILT-IN TEST METHODS 
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;i0minal/Si'UTO0'-?i 



EENSGR 

LIMIT 

REMARKS 


.FUEL . PRE3URSEA..XVER ^TEMPERATURE 

FUEL. PRE.3URNER -TEMPERATURE 

-2ZSD -R 

•TEMPERATURE SP-IXE ABOVE This level 
LIMITEO TO O.S SEC 

OXIDIZER PRSBURNeR OVER 
TEMPERATURE 

OXIDIZER PREBURNER 
TEMPERATURE 

2253 R 

TEMPERATURE SPIKE ABOVE THIS LEVEL 
LIMITED TO 0.5 SEC 

HIGH-PRESSURE FUEL TURBOPU.M? 

SHAFT SPEED 

33,300 RPfl 

REDUCED CESIG.N SAFETY FACTOR AT 
SPEEDS EXCEEDING THE LIMIT 

HIGH-PRESSURE OXIDIZER TUR53- 
PU.M? SHAFT OVER SPEED 

SHAFT SPEED 

4 

28,703 RPH 

REDUCED DESIGN SAFETY FACTOR AT 
SPEEDS EXCEEDING THE LIMIT 

COMBUSTION CHAMBER PRESSURE 
(LOW) 

CHAN3ER PRESSURE 

40 PERCENT 
NPL 

REQUIRES THREE CONSECUTIVE SAMPLES 
EELOU THIS LEVEL* 

COMBUSTION CHAMBER PRESSURE 
(HIGH) 

CHAMBER PRESSURE 

112 PERCENT 
NPL 

REQUIRES THREE CONSECUTIVE SAMPLES . 
ABOVE THIS LEVEL* 

^OXIDIZER HEAT EXCHANGER FAILURE 

HIGH-PRESSURE CXIOIZER 
DISCHARGE PRESSURE AND 
HEAT EXCHANGER OUTLET 
PRESSURE 

dP >57S PSIA 

MALFUNCTION DETECTION TO PREVENT 
HOT GAS BACKFLOW TO VEHICLE 

LOSS OF HIGH PRESSURE 
OXIDIZER TURBO PUMP INTER- 
MEDIATE SEAL ?U 9 GE 

PURGE INLET pp£S5UR£ 

LESS THAN 
40 PSIA 

PREVENT COMMUNICATION Or OXIOIZER 
AND TUR3INE HOT GAS 


POCNTRCLIER SWITCHES TO A HIGH SAMPLE RATE (2C0 SAmPLES/SECONO) TO VERIFY DATA IN TIMELY FASHION ANO TO 
REDUCE TIME TO SHUTDOWN III IT IAT I ON. 


TABLE 4. 3. 3. 2-2 

ENGINE LIMIT CONTROL SHUTDOWN PARAMETERS 
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4.3. 3.3 

Data Transmission - - 




The engine status and maintenance data available for transmission to 
the vehicle via the vehicle/engine data bus are listed in Table 4. 3. 3. 3-1. 

The data rate in samples per second is indicated for each parameter versus 
the mission phases. Data are transmitted in bytes consisting of 8 binary bits. 
The data are arranged in blocks which are transmitted to the vehicle at a 
maximum rate of 25 times per second. Engine data which are obtained at 
sample rates higher than 25 samples per second are stored by the controller 
for transmission in the next block of data. For example, each block of data 
transmitted at 25 times per second contains 4 samples of each parameter which 
is sampled at 100 samples per second. The first byte normally transmitted 
with each block of data is the engine status byte defined by Table 4. 3. 3. 3^2. 

The engine status byte identifies to the vehicle: 

1. The engine phase of operation (3 bits). 

2. The mode within the phase (3 bits). 

3. The self test status (2 bits). 


__2 5 1 Octal number 

^ 010 101 01 Binary equivalent 

For example, the engine status byte indicates: 

1. That the start preparation phase was entered. 

2. That the modes were completed to a valid "engine ready". 

3. That the engine is satisfactory (no failures). 

Since the engine is in the start preparation phase, the data available 
to the vehicle is that listed under the column "Start Preparation" in Table 
4. 3. 3. 3-1. All bytes are arranged in blocks to fit within the 10,000 bit/second 
limit. . . 





10/20/72 


4-61 


DATA OYTE (3 Sits) 


{.'.•s' STATUS 

PATIO <2 BYTES) 

T.I*ST (J BYTES) 
nr..;< IDENTIFICATION 
P:RA-IT£R VALUE OF OATA BYTE NO. S 
V.J PRESSURE FUEL TURBOPUNP 
:is:-ar:e pressure 
OISC-aROE TEMPERATURE 
S-AFT S C EED 
- t:ry fa c «» COE t EBO« E TEA 
F'.Et FLOW SATE (LEAST SIGNIFICANT BYTE) 
T.1L FLO* BATE *,“0S7 SIGNIFICANT BYTE ) 
«i'.~ PRESSURE FUEL TURoCPUN? 

:isc-.*-»:e fee ssu ?e 

S-AFT SPEED 
A.OIAL ACCELEROMETER 
f. It p:j?.;?N-R PRESSURE 
FlEL F»£5S s .a£S. TEMPERATURE 

pressure cxioher tursopump 
9.1 pressure 

S-.aF r S = E£D 

accelerometer 

mIG* PRESSURE OXIDIZER TUREOPUM? 

CISCy-a:;? PRESSURE 

ii;:*A’:e temperature 

s: :st stage discharge pressure 

S-AFT SPEED 

»>:iiL accelerometer 
ltj fl:« fate (least significant byte) 
l:» fl;j ».ate (-set significant byte) 
c t . i ; i a r f£S.»n£R PRESSURE 
JpOI.'ER s RE:URnER TEmPcRATuRE 
-A.N C:-?..STlON CHAMBER fuel 
•N. tlTiCN' PRESSURE 

-a:y C:»E-;STI5n CHAMBER PRESSURE <Z BYTES) 

-a;n c:*bustion chamber coolant temperature 

:i*:i;e» tans pressu.vst pressure 

*.»i* ::-?.s7i3'< cma.-eer coolant pressure 

-'O'AluiC system pressure 

IIT'.-OIBLE NOZZLE POSITION 

mm/» FUEL valve POSITION 

**n :h;i:e» valve fqsiticn 

cg-bjsticn cham3es coolant valve 

.'TSITITN 

P*-=.RSER OXIDIZER valve position 
-•O lZTR ft RE SvRNER OXIOIZER VALVE POSITION 
'-C. 5-.EE3 POSITION 
:»'j!ZER 3 Lc to POSITION 
*■-» S»S t £n F-P-'.E PRESSURE 
M» S’STf-1 PURSE PRESSURE 

'■■■" s < i oiie.r turbopun? liftoff 

•II. R*0 BlZEO VALVE CONTROL PRESSURE 
*•■-* »«ESS.R£ FUEL TURBC 5 UM? LIFTOFF SEAL 
A'O S.SEO VALN* CONTROL PRESSURE 
••■I SEAL PURGE PRESSURE 

* *i •: r s«-:*cE 

* *»-*.’s£R LONGITUDINAL ACCELEROMETER 

:• :>;<• longitudinal 

* ' : i .t 1 :** ter 

» z *“ T -ST I ON CHA.-SER LONGITUDINAL 
T-i’£» 

- in’-RnAl PRESSURE 

’ 1 - ’■ i-'EPnAl TE-PEPATURE 

Ok** (IN RESERVE) 


GROUND 

CHECKOUT 


START 

PR£?A.?.AT ION START 


“AINSTAr.E 


POST 

SHUTDOWN shutdown 


AmPLES PER SECOND 


22 

21 

2k 

25 

26 

.. 23 
.23 

30 

31 



TABLE 4. 3. 3. 3-1 

DATA TRANSMITTED TO VEHICLE BY ENGINE MISSION PHASE 
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The order of transmission is fixed by the engine operating phase. 

The total data rates versus phase are listed in Table 4. 3. 3. 3-5. Start and 
shutdown have the highest data rates. 

Failure identification information is contained in data bytes 6 
and 7 listed in Table 4. 3. 3. 3-1. Table 4. 3. 3. 3-4 is a list of failure modes 
and line replaceable units which will be identified to the vehicle. Byte 
number 51 in Table 4. 3. 3. 3-1 is a timing pulse which is issued to correlate 
events with the time they occur. 

4. 3. 3. 4 Controller Built-in Test 

The controller built-in-test is initiated by the executive program 
and is performed once in its entirety each time through the 20 msec major cycle 
of the executive program. It is performed continuously throughout all phases 
of ground and flight operation. The built-in-test starts with a complete 
checkout of the dual digital computers. Upon verification of the operability 
of the computer processors and memories, the checkout is expanded to the digita 
computer interface electronics, the input electronics, the output electronics, 
and the power supply electronics. The interrelationship of these major 
controller sections is shown in Figure 4. 3. 3. 4-1. The input electronics 
conditions the^jensor inputs and converts them to a digital format. The output 
interface electronics converts the digital computer outputs to the form requirec 
to drive output devices such as actuators, valves, and spark igniters. The 
computer interface electronics provides the interface between the dual digital 
computers and all computer inputs/outputs. The power supply electronics 
converts the electrical power supplied by the vehicle to the individual power 
supply voltages required by the controller.: 







- 398 - 8 - 


DATE 10/20/72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE N0. 4 . 63 

REV. 

BINGHAMTON. NEW YORK 

.. . - - - • • - — 1 

REP. NO. 


4. 3. 3. 4.1 Computer Checkout 

The sample problem tests every instruction in the 
computer's repertoire and performs a complete test of every 
section of the processor and memory. Memory parity checking is 

used to check the data obtained from the memory. A parity bit is 
generated and stored during each memory write operation so that 
every word stored in memory including the parity bit has an odd 
number of ones. Upon each memory read operation, the parity of 
the word extracted from memory is verified to be odd. * - , 

The checkout of the memory is concluded by the testing of the 
parity hardware. Several known constants, some with odd and some with even 
parity, are fetched from the memory, and the parity checking hardware is monitored 
to verify that it can distinguish between odd and even parity. The parity- 
generating hardware is also checked by performing alternate store and fetch 
instructions using several constants. 

During ground checkout, an additional test of the fixed portion 

i 

of the memory is made by a memory sum check. This verifies the integrity j 

of the computer program and assures that each location in fixed memory can be 
addressed. 

4. 3. 3. 4. 2 Computer Interface Electronics Checkout f 

Upon successful completion of the total processor and memory checkou;,: 

the sample problem initiates the checkout of the computer interface electronics. 
Each of the dual digital computers has a dedicated set of computer interface 
electronics to perform the functions of: 
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3 
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5 
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fail safe 
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6 

(RESERVE) 

(RESERVE) 

ENGINE UNIT 
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' 

7 
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1. Controlling flow of digital data to and from the computer, 
vehicle/engine data bus interface, and memory. 

2. Monitoring computer operation to ensure fail safe computer 
monitoring and fail operational controller operation. 

3. Providing a redundant time reference to the digital computer. 

The control of digital data flow is through three separate electronic 

circuits: 

1. Direct Memory Access Control - controls the direct data flow 
in and out of the memory. 

2. Input Multiplexer Electronics - provides the data flow path 
between the controller inputs and the memory. 

3. Data Bus Multiplexer Electronics - provides communication 
with the vehicle data bus. 

■2 These three circuits are checked out together with end-to-end 

test. Under direct memory access control, data are transferred via the direct 
memory access output into the data bus multiplexer electronics data register. 

This data are then transferred back into memory via the input multiplexer 
electronics. The input data are then compared to the initial data to verify the 
correct operation of the direct memory access control, data bus multiplexer 
electronics and the input multiplexer electronics. The interface between the 
data bus multiplexer electronics and the vehicle data bus is automatically 
checked every time a command from the vehiclejs received and validated: the 

controller responds by transmitting engine status. 

2 Two watchdog timers are used with each computer to ensure fail 

safe computer monitoring and fail operational controller operation upon a 

j 

watchdog timer failure. The watchdog timers verify that each computer is | 
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1, CONTROLLER CHANNEL I 

2, CONTROLLER CHANNEL 2 

3, AASEO'JS N I TROGEN SYSTEM PURGE CONTROL VALVE 

4, HELIUM FUEL SYSTEM PURGE CONTROL VALVE 

5, EMEROENCY SHUTOOWN CONTROL VALVE CHANNEL I 

6 , EMERGENCY SHUTOOWN CONTROL VALVE CHANNEL 2 

7, BYPASS CONTROL VALVE 

8 , LIFTOFF SEAL AND BLEED VALVE CONTROL VALVE (FUEL) 

9, LIFTOFF SEAL AND BLEED VALVE CONTROL VALVE (0XIDI2ER) 

10, INTERMEDIATE SEAL PURGE CONTROL VALVE CHANNEL I 

11, INTERMEDIATE SEAL PURGE CONTROL VALVE CHANNEL 2 

12, SYSTEM PURGE PRESSURE SENSOR 

13, HELIUM FUEL SYSTEM PURGE PRESSURE SENSOR 

14, LIFTOFF SEAL ANO BLEED VALVE PRESSURE SENSOR (FUEL) 

15, LIFTOFF SEAL AND 8LEE0 VALVE PRESSURE SENSOR (OXIDIZER) 

16, INTERMEDIATE SEAL PURGE PRESSURE SENSOR 

17, FUEL PREBURNER IGNITER NO. I 

18, FUEL PREBURNER IGNITER NO. 2 

19, OXIDIZER PREBURNER IGNITER NO. I 

20, OXIDIZER PREBURNER IGNITER NO. 2 

21 ^ HA* IN COmOUSTION CHAMBER IGNITER NO. I 

22. MAIN COMBUSTION CHAM 8 ER IGNITER NO. 2 

23. MAIN FUEL VALVE ACTUATOR CHANNEL I 

24. MAIN FUEL VALVE ACTUATOR CHANNEL 2 

25. MAIN OXIDIZER VALVE ACTUATOR CHANNEL I 

26. MAIN OXIDIZER VALVE ACTUATOR CHANNEL 2 

27. COMBUSTION CHAMBER COOLANT VALVE ACTUATOR CHANNEL I 

28. COMBUSTION CHAM 8 ER COOLANT VALVE ACTUATOR CHANNEL 2 

29. FUEL PREBURNER OXIDIZER VALVE ACTUATOR CHANNEL I 

30. FUEL PREBURNER OXIDIZER VALVE ACTUATOR CHANNEL 2 

31. OXIDIZER PREBURNER OXIDIZER VALVE ACTUATOR CHANNEL I 

32. OXIDIZER PP.EBURNER OXIDIZER VALVE ACTUATOR CHANNEL 2 

33. EXTENDIBLE NOZZLE ACTUATOR CHANNEL I 

34. EXTENDIBLE NOZZLE ACTUATOR CHANNEL 2 

35. FUEL BLEED VALVE POSITION SENSOR 

36. OXIDIZER BLEED VALVE POSITION SENSOR 

37. EXTENDIBLE NOZZLE RETRACTEO POSITION SENSOR CHANNEL I 

38. EXTENDIBLE NOZZLE RETRACTED POSITION SENSOR CHANNEL 2 

39. EXTENDIBLE H022LE EXTENDED POSITION SENSOR CHANNEL I 

40. EXTENDIBLE NOZZLE EXTENOEO POSITION SENSOR CHANNEL 2 

41. LOW-PRESSURE FUEL TURBOPUMP DISCHARGE PRESSURE/ 
TEMPERATURE SENSOR NO. I CHANNEL I 

42. LOW-PRESSURE FUEL TURBOPUMP DISCHARGE PRESSURE/ 
TEMPERATURE SENSOR NO. I CHANNEL 2 

43. LOU-PRESSURE FUEL TURBOPUMP DISCHARGE PRESSURE/ 
TEMPERATURE SENSOR NO. 2 CHANNEL 1 

44. LOW-PRESSURE FUEL TURBOPUMP SHAFT SPEED SENSOR 
CHANNEL I 

45. LOW-PRESSURE FUEL TURDOPUMP SHAFT SPEED SENSOR 
CHANNEL 2 

46. LOW-PP.ESSURE FUEL TURBOPUMP RADIAL ACCELEROMETER 
SENSOR 

47. FUEL FLOWRATE SENSOR NO. 1 CHANNEL I 

48. FUEL FLOWRATE SENSOR NO. I CHANNEL 2 

49. FUEL FLOWRATE SENSOR NO. 2 CHANNEL I 

50. FUEL FLOWRATE SENSOR NO. 2 CHANNEL 2 

51. FUEL PRE 8 UP.HER TEMPERATURE S^ISOR NO. I 

52. FUEL PREBURNER TEMPERATURE SEFffOR NO. 2 

53. FUEL PREBURNER PRESSURE SENSOR CHANNEL I 

54. HIGH-PRESSURE FUEL TURBOPUMP DISCHARGE PRESSURE 
SENSOR CHANNEL I 

55. HIGH-PRESSURE FUEL TURBOPUHP DISCHARGE PRESSURE 
SENSOR CHANNEL 2 

56. HIGH-PRESSURE FUEL TURBOPUHP SHAFT SPEED SENSOR 
CHANNEL I 

57. HIGH-PRESSURE FUEL TURBOPIIMP SHAFT SPEED SENSOR 
CHANNEL 2 

58 . HIGH-PRESSURE FUEL TURDOPUMP RADIAL ACCELEROMETER 
SENSOR 

59. FUEL PREBURNER LONGITUDINAL ACCELERATION SENSOR 

60. LOW-PRESSURE OXIOIZER TURBOPUMP DISCHARGE PRESSURE 
SENSOR CHANNEL I 

61. LOW-PRESSURE OXIDIZEO TUR50PUMP DISCHARGE PRESSURE 
SENSOR CHANNEL 2 

62. LOU-PRESSURE OXIDIZER TURBOPUHP SHAFT SPEED SENSOR 
CHANNEL t 


63. LOW-PRESSURE OXIOIZER TURBOPUHP SHAFT SPEED SENSOR 
CHANNEL 2 

64. LOW-PRESSURE OXIOIZER RADIAL ACCELEROMETER SENSOR 

65. HIGH-PRESSURE OXIDIZER TURBOPUHP DISCHARGE PRESSURE/ 
TEMPERATURE SENSOR NO. I CHANNEL I 

66 . HIGH-PRESSURE OXIOIZER TURBOPUHP DISCHARGE PRESSURE/ 
TEMPERATURE SENSOR NO. 1 CHANNEL 2 

67. HIGH-PRESSURE OXIDIZER TURBOPUMP DISCHARGE PRESSURE/ 
TEMPERATURE SENSOR NO. 2 CHANNEL I 

68 . HIGH-PRESSURE OXIOIZER TURBOPUHP BOOST STAGE 
IMPELLER DISCHARGE PRESSURE SENSOR 

69. HIGH-PRESSURE OXIDIZER TURBOPUMP RADIAL 
ACCELEROMETER SENSOR 

70. OXIDIZER PREBURNER TEMPERATURE SENSOR NO. I 

71. OXIDIZER PREBURNER TEMPERATURE SENSOR NO. 2 

72. OXIDIZER PREBURNER PRESSURE SENSOR NO. I 

73. OXIDIZER PREBURNER LONGITUDINAL ACCELEROMETER SENSOR 

74. OXIDIZER FLOWRATE SENSOR NO. I CHANNEL I 

75. OXIOIZER FLOWRATE SENSOR NO. I CHANNEL 2 

.76. OXIOI.ZER FLOWRATE .SENSOR HO. 2 CHANNEL I 

77. OXIDIZER FLOWRATE SENSOR NO. 2 CHANNEL 2 

78. OXIDIZER TANK. REPRESSURIZATION PRESSURE SENSOR 
CHANNEL I 

79. OXIDIZER TANK REPRESSURIZATION PRESSURE SENSOR 
CHANNEL 2 

80. COMBUSTION CHAMBER FUEL INJECTION PRESSURE SENSOR 
CHANNEL I 

81. COMBUSTION CHAMBER PRESSURE SENSOR NO. I CHANNEL I 

82. COMOUSTION CHAMBER PRESSURE SENSOR NO. I CHANNEL 2 

83. COMBUSTION CHAMBER PRESSURE SENSOR NO. 2 CHANNEL I 

84. COMBUSTION CHAMBER COOLANT OUTLET TEMPERATURE SENSOR 
CHANNEL I 

85. COMBUSTION CHAMBER COOLANT OUTLET PRESSURE SENSOR 
CHANNEL I 

86 . HYDRAULIC SYSTEM PRESSURE SENSOR CHANNEL I 
8 ?. HYDRAULIC SYSTEM PRESSURE SENSOR CHANNEL 2 

88 . CONTROLLER INTERNAL TEMPERATURE SENSOR CHANNEL 1 

39. CONTROLLER INTERNAL TEMPERATUPE SENSOR CHANNEL 2 

90. CONTROLLER INTERNAL PRESSURE SENSOR CHANNEL I 

91. CONTROLLER INTERNAL PRESSURE SENSOR CHANNEL 2 

92. OXIDIZER. INLET PRESSURE NOT READY 

93. OXIDIZER INLET TEMPERATURE NOT READY 

94. FUEL INLET PRESSURE NOT READY 

95. FUEL INLET TEMPERATURE NOT READY 

96. HYDRAULIC SYSTEM PRESSURE NOT READY 

97. MAIN FUEL VALVE POSITION NOT READY 

98. MAIN OXIDIZER VALVE POSITION NOT READY 

99. FUEL PREBURNER OXIDIZER VALVE POSITION HOT READY 

100. OXIDIZER PP.EBURNER OXIOIZER VALVE POSITION NOT 
READY 

101. COMBUSTION CHAMBER COOLANT VALVE POSITION NOT READY 

102. FUEL PREBURNER TEMPERATURE OUT OF LIMITS 

103. OXIDIZER PREBURNER TEMPERATURE OUT OF LIMITS 

104. HIGH-PRESSURE FUEL TUP.BOPUMP SHAFT SPEED 
OUT OF LIMITS 

105. HIGH-PRESSURE OXIDIZER TURBOPUMP SHAFT SPEED 
OUT OF LIMITS 

106. COMBUSTION CHAMBER PRESSURE OUT OF LIMITS 

107. OXIOIZER TANK REPRESSURE OUT OF LIMITS 

108. THROUGH 255 ARE SPARES 


NOTE: CHANNEL INCLUDES SENSOR, HARNESS, CONNECTORS 

ANO CONTROLLER INPUT ELECTRONICS. 


TABLE 4. 3. 3. 3-4 


FAILURE IDENTIFICATION 
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FIGURE 4. 3. 3. 4-1 

ENGINE CONTROLLER FUNCTIONAL RELATIONSHIPS 
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progressing through its program and is executing program instructions per a j 
predetermined schedule. The watchdog timer is a simple timing circuit that 
checks the time it takes the computer to progress between checkpoints in the 
computer program. Imbedded within the program are instructions requiring the 
computer to reset each timer, at different points in the program's execution, 

•i-n-a -sequeatia.l fashion. Each subroutine includes an instruction to reset only 
one of the watchdog timers, thus ensuring detection of a computer failure that 
prevents the computer from returning to the executive program on schedule. 

If either of the computers fails to reset either of its watchdog timers, the 
watchdog timer output switches to zero. 

2 Each computer monitors the watchdog timer output of the other 

to determine operational status. This status is made available to the vehicle 
by the controlling computer (initially Channel 1 computer). 

2 The output switch, which determines which computer is in control, 

is controlled by the Channel 1 computer watchdog timer output. Channel 1 

computer maintains engine control as long as it remains failure free. Upon i 

! 

failure of Channel 1 computer, its watchdog timer output goes to zero, thus j 

1 

switching engine control to the Channel 2 computer. 

2 All processor and memory failure modes cause the watchdog timer 

output of the corresponding computer to switch to zero. The watchdog timer 
output is used to command a HALT instruction in a failed computer. The HALT 
instruction prevents the computer processor from executing any further instructions 
to ensure that the failed computer does not output actuator commands or data 
to the vehicle data bus. 
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The proper operation of the watchdog timers is checked during grounc 
checkout. The decay time of the watchdog timers is speeded up by switching 
in checkout circuitry. The watchdog timer output of each computer is monitored 
to verify that the watchdog timers will switch to zero if not reset within a 
specific time interval. All the failure modes of the watchdog timer test 
circuitry tend to shorten and not legnthen the timer delay times, thus 
ensuring a shutdown of the corresponding computer upon a failure. 

Two real time clocks are used with each computer to provide: 
fail-safe computer operation. During each controller test cycle, the two clocks 
are monitored to verify that they agree. If the clocks do not agree, the 
malfunction is detected and the corresponding computer channel is commanded to 
a HALT instruction. The watchdog timers run down causing control to switch 
if the failure is in Channel 1 computer. If both clocks are stopped but 
still agree, the failure is detected by the watchdog timer. In this case, 
the processor will not return to the executive program in time to reset one 
of the watchdog timers and the timer output will go to zero. 

4. 3. 3. 4. 3 Input Electronics Checkout 

Checkout of the input electronics is achieved by the sample problem 
program. The input electronics processes analog and pulse rate data from the 
engine-mounted sensors. These data are converted into a digital format for 
inputting to the digital computer memory via the computer interface electronics. 
The input electronics consists of low-level and high-level multiplexer gates, 
amplifiers, demodulators, pulse rate converters and analog to digital converters 
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Internal reference voltages are applied at specific low- and high- 
level multiplexer input gates. These voltages have been incorporated to aid 
in checkout. The reference signals are monitored at the output of the analog 
to digital converters by the computers to verify operation of amplifiers and 
the analog to digital converters. These reference voltages are also used by 
.the ..computers,,. to measure Mas.,and .. offsets .in the input channels . This informal on 
is used by the computers to provide a continuous recalibration of the input 
channels by automatic software changes. The remaining portion of the input 
electronics checkout is accomplished during sensor input monitoring and process' ng 
discussed in 4. 3. 3. 5. 

4. 3. 3. 4. 4 Output Electronics Checkout 

The output electronics converts the digital computer commands to 
voltages for controlling the valve actuators, solenoid valves, and igniters. 

All of the controller outputs are continuously verified by the computers. The 
controller output voltages are fed back to the input electronics and are 
processed through the multiplexer gates and analog to digital converters, in 
the same fashion as the sensor inputs, and are stored in memory. The controller 
output data are then compared to the commanded data and verified to be correct. 
This test provides a complete checkout of the output electronics. Upon 
detection of a malfunction of the controlling output channel, engine control is 
switched to the second output channel. 

4.3.3:415 Power Supply Electronics Checkout 

Built-in test circuits continuously monitor the controller supply 
electronics. Five internal controller power supplies, each capable of operating 
from either vehicle power bus, provide internal controller power distribution. 
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The five power supplies provide power to the triple redundant input electronics: 
to the dual redundant digital computers/interface electronics, and to the dual 
redundant output electronics. 

Each power supply includes circuitry in the regulators that monitorj 
regulator performance and turn off the power supply upon detection of a 
malfunction. The operational status of all power supplies is continuously 
monitored as part of the controller self-test. The completion of the power supply 
electronics checkout completes the controller built-in test. The engine 
controller has been completely checked out during the controller built-in 
test with the exception of the sensor input multiplex gates which are checked 
as part of the sensor built-in test. 

4. 3. 3. 5 Sensor Built-in Test 

Computer Channels 1 and 2 both conduct all tests. Computer Channel 2 
conducts all tests, storing results in memory in case computer Channel 1 fails 
requiring computer Channel 2 to assume control. 

4. 3. 3. 5.1 Sensor Ground Checkout 
All sensors except nonflight data sensors are functionally 

tested during the automatic ground checkout. 

4. 3. 3. 5. 2 Sfrftsor Inflight Monitoring 
Three levels of sensor redundancy are used in the engine system: 

1. Triple redundant sensors are used for performance control. 

2. Dual redundant sensors are used for engine ready checks and 
limit control. 

3. Nonredundant sensors are used for acquisition of maintenance 
data for transmission to the vehicle and recording. 
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If only two of the three sensor channels pass the above tests, 
the average value of the two agreeing channels is formed and this value is 
used to update the memory. If the same sensor channel does not pass the above 
tests three times in succession, it is assumed that the sensor channel has 
failed and that channel is not used in future processing. An alternate sensor 
value '('Computed from-'other ‘sensed ^parameters, ..Table 4..3..3.5.2-2) is used to 
replace the failed sensor channel. 

The performance control operates with two of the original sensors 
and an alternate computed sensor value as before. The sensor tests are conti nuep 
with the new set of triple redundant sensor value as before. The sensor tests 
are continued with the new set of triple redundant sensors. Upon a second 
failure, the performance control continues to operate using the value of the 
good sensor and the alternate computed value. Thus a fail operational capability 
is provided for second failures of performance control sensors without an 
increase in sensor count. 

A third sensor channel failure- is detected either by the reasonablen 
tests or comparison failure limits test. A third failure results in computer 
Channel 1 being shut down. If the failure is in the sensors and not the signal 
conditioning electronics, computer Channel 2 will also have detected the failure^ 
and shut down. If the failure were in the signal conditioning electronics 
dedicated to Channel 1 computer, the Channel 2 computer will continue to operate 
and control the engine. 

The dual redundant sensors used for engine ready and the engine limi 
control are checked for reasonableness by comparing their outputs with minimum 
and maximum limits similarly to the performance control sensors. If either 


ess 
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sensor channel indicates that the engine is within operating limits, the 
engine is safe and is allowed to operate normally. If both outputs from a set 
of dual redundant sensors indicate that a limit has been exceeded in three 
successive samples, an engine failure is assumed and the engine is shutdown. 

The nonredundant sensors used only for acquiring maintenance 
data are not tested in flight operation. These sensors are noncritical and 
do not affect control functions. 

4. 3. 3. 6 Actuator/Valve Built-in Test 

The controller performs failure monitoring of the actuators and 
valves by use of actuator/valve position sensors. The modulating-type 
hydraulic actuators contain dual redundant servovalves to provide a fail 
operational /fai 1 safe capability. A penumatic shutdown system provides actuator 
fail safety in case of loss of hydraulic power or loss of electronic control 
to the actuator. Pressure ladder-sequenced penumatic actuators and motors 
provide this shutdown capability to the valves and retraction capability to 
the orbiter nozzle. The controller contains provisions to detect failures 
and to switch out failed elements. 

Monitoring of the actuators is accomplished by use of an analog electro 
servovalve model. The model receives the same commands as the servovalve and 
electrically models the normal servovalve output spool position. The outputs of 
the servovalve and the electronic model are compared. If a servovalve failure 
is detected, the failed servovalve is isolated from the actuator and a redundant j 
standby servovalve is switched in to control the actuator. Monitoring of the 
standby servovalve is accomplished in a similar manner. 
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CONTROL PARAMETER 

REASCnASiE-S'ESS 


— 

mm 

fViXI-UM 

' 

« -wrfrccriausT icn cka.^se?. sure 

1233 PSIA 

3453 PSIA 

4 PERCENT FULL SCALE 

high-pressure OXIDIZER PUMP 




DISCHARGE PRESSURE ' 

1750 PSIA 

6140 PSIA 

4 PERCENT FULL SCALE 

DISCHARGE TEMPERATURE 

170 R 

. 200 R 

1.5 R 

FLO* RATE 

580 L2/SEC 

157 5 LS/SEC 

0.1 PERCENT* 4 

LOW-PRESSURE FUEL PUMP 



' * 

• , 

DISCHARGE PRESSURE 

45 PSIA 

230 PSIA 

4 PERCENT FULL SCALE 




* 

01 SCHARGE TEMPERATURE 

36 R 

SO R » 

0.5 R 

FLOWRATE 

« - - — 

35 L2/SEC 

250 L3/SEC 

2.1 PERCENT** I 


‘APPLICABLE IN 40 PERCENT TO 1 1 2 PERCENT OP NPL RANGE OF THRUST 
“COMPARISON 8ETWEES DIGITIZED PULSE RATE SIGNALS 


TABLE 4 . 3 . 3 . 5 . 2-1 


PERFORMANCE 


CONTROL SENSOR-REASONABLENESS AND COMPARISON 


FAILURE LIMITS 
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The controller also compares the actuator position feedback signals 
with the actuator position command to detect actuator failures not detected 
by monitoring of the servovalves. Upon a failure of both servovalve channels, 
or a failure detected by monitoring actuator position, the penumatic shutdown 
assumes control. This monitoring procedure is used during both ground and 
"f Ti ght w ope rati on . 

Built-in test of the penumatic purge valves is provided by measure- 
ments of penumatic pressure. Indicated failures are isolated by the electrical 
stimulation test of the pressure sensor to distinguish between sensor failures 
and valve failures. 

4. 3. 3. 7 Spark Igniter BUilt-in Test 

Each igniter circuit provides an output which is monitored for spark j 
rate and voltage level. This allows verification of igniter operation during 
both ground checkout and flight operation. 

4.3.4 Instrumentation Parameter List | 

The engine is equipped with sensors to provide data acquisition during 

> 

engine flight and non-flight operations. Dual sensing elements are provided 
for pressure, cryogenic temperature, flow and pump speed pickups. 

Parameters for data acquisition are listed in Table 4. 3. 4-1. This 

i 

list was developed from studies covering: 

1. The dynamic simulation for selecting the control system. 

2. Verification of the operational readiness condition of the engine 
through checkout. 

3. Requirements for engine readiness prior to start. 

4. Establishing performance and trend analysis of the engine and 

subsystems. 
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The table shows the usage of sensor outputs for achieving the following' 
functions: 

. 1. Performance Control. 

2. Limit Control. 

3. Position Indication. 

4.. .Engine.. Ready. 

5. In-flight Maintenance Recording. 

6. Non-flight Data Acquisition. 

The non-flight data are provided at a connector panel attached to the 
controller. 

4. 3.4.1 Alternate Performance Control Parameters 

Alternate performance control sensors are listed in Table 4.3.4. 4- 1 . 
Engine performance is maintained within specification requirements with the use 
of these alternate values after the first and second sensor output failure. 
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FUNCTIONAL use 




SUBSYSTEM 

An3 

PARAMETER 


LOV-PRESSUR 


DISCHARGE 

PRESSURE 


DISCHARGE 


REQUIREMENTS 


SENSOR f 

quantity sensor g; 

AND. TYPE OUTPUTS ‘i ' 


2| DC; 
INTEGRAL 


RANGE , 0 TO ACO PSIA; 
ACCURACY ±2 PERCENT 
FULL SCALE; RESPONSE, 

0 TO ICO HZ; PROCURE- 
MENT SPECIFICATION, 
RC7033 < 


RANGE, -623 TO +700 F; 2; OC ; 


•TEMPERATURE , .ACCURACY, .= 2 PERCENT 
OPERATING FANGS; 
RESPONSE, 0.2 SECOND 
TIME CONSTANT; PRO- 
CUREMENT SPECIFICA- 
TION, RC7003 

SHAFT RANGE, 0 TO 20,000 

SPEED P.PM; ACCURACY, =1 

RPH; PROCUREMENT 
SPECIFICATION, RC7005 

RAD I AL 

ACCELERATION RANGE. 10 TO 6030 HZ. 
0 TO 300 GRMS; 
ACCUFACY,±0.2 HV/G; 
PP.CCURENEMT SPECIFI- 
CATION, ac 7006 


FLOVRATE 


RANGE. 0 TO 18,000 
GPM; ACCURACY, =20 
CPH; RESPONSE, ’00' 
RAO/SEC; PROCURE- 
MENT SPECIFICATION, 
RC7005 


HICN-PRESS'JRE FUEL TU.ESO’U-'P ’S3 PRE3URHER 

DISCHARGE PAMGE, 0 TO 7500 1 J DC 

PRESSURE PSIA; ACCURACY, ±2 


PRE5UANE.R 

PRESSURE 


P.RE BURNER 
TEMPERATURE 


RANGE , 0 

TO 7500 

PSIA; AG 

CURACY, ±2 

PERCENT 

FULL SCALE; 

RESPONSE 

, 0 TO 100 HZ; 

PROCURE.* 

ENT S’ECIFI- 

CATION, 

RC700I 

RANGE, 0 

TO 6030 

PSIA; AC 

CURACY, ±2 

PERCENT 

FULL SCALE 

RESPONSE 

, 0 TO 103 HZ; 

PROCURER 

ENT SPECIF!- 

CATION, 

?S*SOI 

RANGE, 0 

TO 2-00 F; 

ACCURACY 

, = ’ PERCENT 

GPEPAT IN 

Z rAH££; 

RESPONSE 

, 0.5 SECOND 

TIME CON 

SCANT; PRO- 

CUS-MEST 

SPECIFICA- 

TION, s; 

723"» 

RANGE, 0 

TO 65,000 

R?.“; ACC 

URACY. =1 

RPtf; ?nZ 

CUR E-“ ENT 

SPECIFIC 

AT ION, RC 7005 


A ;B ; A ;8 ; 


INTEGRAL I I 
A :B 


A ;B ; A ;B ; 
II II 


A ;B ; A ;B j 
II II 


OUAL CONNECTORS; ? U - PICKJ?; A, 8 - SENSOR OUTPUTS; SUBSCRIPTS - SENSOR NO. I AN 3 SENSOR NO. 2 OF REDUNDANT SETS 




TABLE 4. 3. 4-1 

INSTRUMENTATION PARAMETER LISTS 
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W 




* 

UJ 



• 




O 



X 

u 







X 



o 

£ O 



i 




< 



X — 

< X 



p 




X. _J 

-J 


O W 


=» 


SUBSYSTEM 


SENSOR 


O aC 

>- s' 

UJ 

X >. 

— < 

UJ ^ 
B- cC 

UJ O 

X *£ 

_j 

AND 


QUANTITY 

SENSOR 

cC X 

X X 

u <z 


X o 
— u 

— u 
c w 

i c 

PARAMETER 

REQUIREMENTS 

AN3 TYPE 

OUTPUTS 

a. lj 

_J «J 

X w 
uj sC 


< UJ 
X OC 

X x 

UJ u 

o < 

X o 

RADIAL 

RANGE , 0 TO 6CCD HZ, 

1 

A 




.. 

A 


„ 

ACCELERATION 

0 TO 303 CRMS; ACCU- 
RACY = 0.2 MV/C; PRO- 
CUREMENT SPECIFICA- 
TION, RC 7306 










PP.ESURNER 

RANGE , 100 TO 15,000 

t 

A ; A 

•• 

__ 

' 


A 

-- • 

A 

L.CKC1TUDIKAL 

HZ. 0 TO 503 CRmS ; 


1 2 





1 


2 

ACCELERATION 

ACCURACY, =3.2 MV/G; 
PROCUREMENT SPEC 1 F 1 - 











CATION, RC7035 

•• 


- 


L 

- 




LOW-PRESSURE OX 

1 01 ZER TUREOPL'MP 










DISCHARGE 

RANGE, 0 TO 603 PSIA; 

2; OC 

A ; B 



A ; A 


A *A 


B 

PRESSURE 

ACCURACY =2 PERCENT 


1 1 



1 2 


I 2 


2 


FULL SCALE; RESPONSE, 


A ; B 





2 




o TO 100 HZ; PROCURE- 
MENT SPECIFICATION 
RC700I 


2 2 








SHAFT 

SANG c , 0 TO £000 *?h; 

1 

A; 3 



— 


A OR 3 

-- 

-- 

SPEED 

ACCURACY rl R?M; 
PROCUREMENT SPECIFI- 




* 







CATIC.N, RC7005 









V 

RADIAL 

RANGE , 10 TO 6000 HZ. 

1 

A 

— 


— 

— 

A 

•• 

-- 

ACCELERATION 

0 TO }G0 CP-MSi 
ACCURACY, =0.2 MV/5; 
PROCUREMENT SPECIFI- 
CATION, SC 7305 







- 



HIGH-PRESSURE 0 

Tl 01 ZER TUR30PUMP AN3 PR 

EPCRNER 









DISCHARGE 

RANGE. 0 TO 60CO PSIA; 

2; CC 

A ; 3 ; 

A ;B ; 


- 

•• 

A +B +A 

-• 

B 

PRESSURE 

ACCURACY =2 PERCENT 

INTEGRAL 

1 1 

1 1 




1 1 2 


2 


FULL SCALE; RESPONSE, 


A ; 3 

A 




i 




0 TO 103 HZ; PROCURE- 
MENT SPECIFICATION, 
RC700J 


2 2 

2 







DISCHARGE 

RANGE, -L 23 TO +700 F; 

2; OC 

A ; 3 ; 

A ;B ; 

— 

A ;A 

— 

A -*-3 +A 

— 

— 

TEMPERATURE 

ACCURACY =2 PERCENT 

INTEGRAL 

1 1 

I 1 


1 2 


1 1 2 


. • 


OPERATING RANGE; 


A ; 3 

A 




> 


- 


RESPONSE, 0.2 SECOND 
TIME CONSTANT; 
PROCUREMENT SPECIFI- 
CATION, RC7003 


2 2 

2 







BOOST STAGE 

RANGE, 0 TO *003 PSIA; 

1; DC 

A; 3 

— 

— 

— 

- 

A 

— 

B 

IMPELLER 

ACCURACY =2 PERCENT 







A 



DISCHARGE 

FULL SCALE; RESPONSE, 










PRESSURE 

0 TO ICO MZ, PROCURE- 
MENT specification. 











RC 730 1 










presurner 

PASGE, 0 TO 6000 PSIA; 

1; OC 

A; a 

— 

— 

— 

— 

A 

— 

8 

PRESSURE 

ACCURACY =2 PERCENT 
FULL SCALE; RESPONSE 
0 TO ICO HZ; PROCURE- 
MENT specification, 
RC700I 











TABLE 4 . 3 . 4-1 

INSTRUMENTATION PARAMETER LISTS (Continued) 















10/20/72 


4-82 


SUBSYSTEM 


SENSOR 


k AMO 


OUANTITY 

SEN 

W PARAMETER 

REQUIREMENTS 

AND TYPE 

OUT 

PRE BURNER 

RANGE , 0 TO 2300 F; 

' 2 

A 

TEMPERATURE 

ACCURACY. =2 PERCENT 
OPERATING RANGE; 
RESPONSE, 0.5 SECONO 
TIME CONSTANT; PRO- 
CUREMENT SPECIFICATION, 
KC700A 


1 

SHAFT 

PAWGE, 0 TO 35,000 

l; DC 

A; 

SPEED 

R?M ; ACCURACY, =1 RPM; 
PROCUREMENT SPECIFICA- 
TION, P.C7005 



RAOiAL 

RANGE, 10 TO 6000 HZ; 

1 


.ACCELERATION 

.0 ,TO.,30O.,GRMS ; 
ACCURACY, =0.2 MV/ G; 
PROCUREMENT SPECIFICA- 
TION, RC7D06 



PRESUP.’IER 

RANGE, ICO TO IS. 000 

2 

A 

LONGITUDINAL 

HZ, 0 TO 500 G R m S ; 


1 

ACCELERATION 

ACCURACY, =0.2 MV/ G; 
PROCUREMENT SPECIFI- 
CATION, RC7006 



OXIDIZER 

PANGS, 0 TO £000 PSIA; 

1; OC 

A; 

TANK 

ACCUP.ACY =2 PERCENT 



PRESSURA.ST 

FULL SCALE; RESPONSE, 



PRESSURE 

0 TO ICO HZ; PRO- 
CUREMENT SPECIFICA- 
TION, P.C 700! 



FLCVRATE 

RANGE, 0 TO 6300 CPM; 
ACCURACY, ±S CPM; 

2; PU 

A 

1 

P 

RESPONSE, 303 RAO / 


A 


SEC; PROCUREMENT 
SPECIFICATION, RC7C05 


2 

MAIN CCMBVSTIO* 

CHAFER 



CCH0US710M 

RANGE, 0 TO J500 PSIA; 

2; OC 

A 

CHAMBER 

ACCURACY, ±2 PERCENT 


i 

PRESSURE 

FULL SCALE; RESPONSE, 


A 


0 TO 100 HZ; PROCURE- 
MENT SPECIFICATION, 


2 


RC700I 



FUEL 

RANGE , 0 TO liCOO PSIA; 

I: DC 

A 

injection 

ACCURACY =2 PERCENT 



PRESSURE 

FULL SCALE; RESPONSE, 

0 TO 100 HZ; PROCURE- 
MENT SPECIF ICATICN, t 
RC703I 

=*■ . 


COOLANT 

RANGE, 0 TO 5000 PSIA; 

1; CC 

A; 

CUTLET 

ACCURACY, ±2 PERCENT 

INTEGRAL 


PRESSURE 

PULL SCALE; RESPONSE 
0 TO ICO HZ; PROCURE- 
MENT SPECIFICATION, . 
RC7C0I 



COOLANT 

RANGE , -A23 TO* 700 F; 

1; OC 

A; 

OUTLET 

ACCURACY, ±2 PERCENT 

INTEGRAL 


TEMPERATURE 

OPERATING RANGE; RES- 
PONSE, 0.2 SECOND 
TIME CONSTANT; PRO- 
CUREMENT SREC 1 F 1 CA- 
TION. SC7002 
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SUBSYSTEM 
AN 3 

PARAMETER 


RE<JU IREhENTS 


SENSOR 

QUANTITY SENSOR 
A NO TYPE OUTPUTS 


LOSS ITUD I HAL RANGE , ICO TO I5.C03 
ACCELERATION HZ, 0 TO 530 CRMS; 

ACCURACY, =0.2 NY/C; 
PROCUREMENT SRECIFI- 
C ATI OH, SC 7006 


ktcraulic 

KYJRAUL I C 
-SYSTEM 
PRESSURE 


RANGE, 0 TO Scoo PS I A; I; CC 
ACCURACY , =2 PERCENT 
FULL SCALE; RESPONSE , 

0 TO ICO HZ; PRO- 
CUREMENT SPECIFICA- 
TION, P.C7C0I 


F LCV CONTROL VALVES POSITIONS 


RANGE, 0 TO 90 CECREcS, 
ACCURACY, ±1 PERCENT 


MAIN FUEL 
VALVE 

MAIN 

OXIDIZER 

VALVE 

SERVOVALVE 


ACTUATOR RANGE, 0 TO 90 OECR.EES 


CC-OLANT 

VALVE 


ACTUATOR RANGE, 0 TO 90 DECREES 


FUEL PRE- 
BURNER 
OXIDIZER 


ACTUATOR RANGE, 0 TO 30 DECREES 


I 


CXIOIZER 

PRESURNER 

OXIDIZER 


ACTUATOR RANGE, 0 TO 90 DECREES 


FUEL ELEEO FANGS, 0 TO 0.IJ3 

VALVE INCH 

OXIDIZER RANGE, 0 TO 0.133 

INCH 





A 

1 

- 

A ♦ 8 

;a 

A OR A 

2 

1 2 

1 


2 


;A 

A ;A 

2 

1 2 

;A 


2 


;A 

A OR A 

2 

I 2 



2 


;A 

A OR A 

2 

I 2 

& 

* A 


2 



A ; A 

2 

1 2 

- 

A 

* 

A 
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SUBSYSTEM 

AND 

PARAMETER 



FUNCTIONAL USE 


SENSOR £ a 
QUANTITY SENSOR ~ ~ 
AND TYPE OUTPUTS Z o 

^ O 



GN PURSE RANGE. 0 TO 1003 PSIA; 

2 ACCURACY -2 PERCENT 

PRESSURE FUEL SCALE; RESPONSE, 

0 TO 100 ME PROCURE- 

MENT SPECIFICATION, 

PC 703 1 


THRUST P.AHCE, 0 TO 1000 PS I A; 

CHAMBER FUEL ACCURACY, z2 PERCENT 


JACRET 

PURSE 

PRESSURE 


FULL SCALE; RESPONSE 
0 TO 100 HE; PR3CURE- 
'MEnT 'SPECIFICATION, 
P.C700I 


HIGH- RAMOS , 

PRESSURE ACCURA 

CXID12ER FULL S 

TURSOPUM? 0 TO I 
LIFTOFF SEAL MENT S 
ANO 0X1 3 I EER RC/ 001 
BLEED VALVE 
PRESSURE 


RAMOS , 0 TO 1000 PSIA; 
ACCURACY, z.2 PERCENT 
FULL SCALE; RESPONSE, 

0 TO 103 HE; PROCURE- 
MENT SPECIFICATION, 


HIOH- 
PRESSURE 
FUEL TVS 20- 
FJ.-P LIFT- 
OFF SEAL 
A-ND FUEL 
BLEED VALVE 
PRESSURE 


RANOE, 0 TO 1003 PSIA; 
ACCL-ACY, -2 PERCENT 
FULL SCALE; RESPONSE, 

0 TO ICO hE; PROCURE- 
MENT SPECIFICATION, 
P.C703I 


HISH- RANOE , 3 TO 1000 PSIA; 

PRESSURE ACCURACY, =2 PER-CENT 

OX 1 0 1 EER FULL SCALE: RESPONSE, 

TURBOPLM? o TO 100 HE; P.ROCLRE- 

ISTE.RMEOIATc MENT SPECIFICATION, 
SEAL P.C700I 

PRESSURE 


INTERNAL 

PRESSURE 


Internal 

TEMPERATURE 


FANSE, 0 TO 50 PSIA; 
ACCURACY, i2 PERCENT 
FULL SCALE; RESPONSE 
0 TO 100 HE; PROCURE- 
MENT SPEC IFICATION 
RC700I ' 

VO, 

RAIICE, -320 TO +300 F; 
ACCURACY, =2 PERCENT 
OPERATING RA.sOE ; 
RESPONSE, I SECOND 
TIME CONSTANT; PRO- 
CUREMENT SPECIFICA- 
TION. NA5-273I5 • 


SERVOVALVE 

POSITION 


A jA 
i 2 
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MAINTENANCE 

recording 
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I 


SL’3SYSTEH 

AND 

PARAMETER 

REQUIREMENTS 

SENSOR t 
QUANTITY 
AND TYRE 

SENSOR 

OUTPUTS 

RunCT 1 0*;AL USE 

Ui 

u 

ae 

5^ 

c: o 
O ec 
u. ►— 

CC Z 
U) o 
a. u 

A 

LIMIT 

control 

Ui 

Z »- 
— O 

o < 

Z ui 

w cc 

POSITION 

INDICATION 

u 

u 

z o 

< X 
X — 
Ui O 

2 O 
— u 

*— 

ui O 
X * 

— u 

a ui 
Ui Ui 

NON-FLIGHT 

DATA 

actuator 


2 

DEI 

— 

— 

— 

A ;A 

A OS A 

A ;A 

-- 

POSIT (CM 







1 2 

1 2 

1 2 


NOZZLE 


2 

1 

— 

— 

— 

• uu 

A OR A 

A ;A 

— 

RETRACTED 



IH 





» 2 

1 2 


NOZZLE 


2 


-- 

— 

A ;A 

— 

A OR A 

A ;A 

— 

EXTENDED 



uMM 



1 2 


1 2 

1 2 
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PERFORM ZCHTP.&l Pfi/Urt TER 

redundant 

SEHSOr.S 

ALTERNATE VALUE COpPUTEO FROM 

nf> 1 S CONS'.' STIOH CKfiHlZR pR £ SSUAE 

2 

MIXTURE ^ at 1 0 AND TOTAL FUEL AND OXIDIZER 

flowrates 

LOW-PRESSURE FUEL TURfi'OPUM? 01 SCRAGS 
PRESSURE 

2 

LOW-PRESSURE FUEL T'jRBOPUflP SPEED FUEL 
FLOWRATES 


2 

NONE 

LOW- PRESSURE FUEL 7L‘*0OPUM? Fl»OV*AT£ 

< 

2 

MAGNETIC PICKUPS 

MAIM COMBUSTION CHAMBER PRESSURE AND 
OXIDIZER FLOWRATE 

LOW-PRESSURE FUEL TURECP'J"? 
DISCHARGE TEMPERATURE 

1 

TURBINE FLOWMETER 


HIOW-PR£SS'JRE OXIDIZES TURSCPU.M? 
FLOWS ATE 

2 

MAGNETIC PICKUPS 
1 

TURBINE FLOWMETER 

MAIN COMBUSTION CHAMBER PRESSURE AMO 
FUEL- FLOWRATE 

P 

^HISS-PRESSURE 0X1 SIZES TUR30PUM? DISCHARSE 
PRESSURE 

2 

LOW-PRESSURE 0X101 ZER TURfiCPUMP DISCHARGE 
PRESSURE; H 1 GH-PRESSURi OXIDIZER TURBO- 
PUMP SPEED MAIN OXIDIZER FLOWRATE 

pifiH-f^essuRS ojnoiiE?. tu^opvm? discharge 

Tc-^PE MATURE 

/ 

2 

• 

NOSE 

' 
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176 


176 


76 


176 


4.3.5 Engine Actuator — — 

The gimballing of the main engine is accomplished by an electro- 
mechanical servo-actuator. The redundancy of components give the actuator 
fail operation capability after first failure and fail-safe after the second 
failure. In the fail safe mode, the actuator returns to neutral. With 
the triple redundant feature of the hydraulic servo valves, the actuator 
•can accept three separate independent input signals. The servo actuator has 
a closed loop hydro-mechanical feedback loop. The developed force, direction 
and rate of position change of the actuator piston are determined by the 
electro-hydraulic servo valve. 

The input hydraulic pressure is 3,000 psig, and the return pressure 
is nominally 45 psig. Using 3,000 psig fluid at 38 + 5 - 20° C, the servo 
actuator has a piston rod maximum velocity of 5.25 inches per second with 
a load of 60,000 pounds. 

The servo has a linear accuracy of 1 ma thru full stroke with a 
hysteresis of less than 1.5 ma. . Threshold signal for piston movement is 
less than 0.5 ma. With no electrical signal to the servo and with 3,000 
psig hydraulic supply, the position of the piston shall be within 0.055 in 
of the reference midstroke position. 

4.3.5. 1 Operating Characteristics 

The servo system has the following general characteristics: 
Frequency response - The system frequency response of amplitude 
ratiorand phase shift is within the limits shown on Figure 4. 3. 5-3 and 
Figure 4.3. 5-4. This is an engine position to current input ratio driven by 
a current source. The nominal phase shift at 1.0 .Hz shall be 17°. This 
applies to inertia loads only. 
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ACTUATOR ENVELOPE-MAXIMUM DIMENSIONS 



ENGINE 

ATTACH 

END 


1. ACTUATOR SHOWN IN NULL POSITION 

2. ALL DIMENSIONS IN INCHES. 



DIMENSIONS 

A 

18.5 

B 

35.5 

C 

3.0 

D 

4.5 

E 

35.5 

F 

43.0 

G 

8.0 

H 

14.0 

I 

4.0 

J 

9.0 


» 


FIGURE 4.3-.5-1 
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Transient response - The response of the load or engine position 
to input signals to the servoactuator as a function of time falls within 
the limits of Figure 4. 3. 5-5. There are no continuing oscillations, limit 
cycling, or hunting in the steady state condition. This requirement applies 
with inertia loads only. 

System stability - With system characteristics as given in 
Figure 4.3.5 t 2, and the actuator bias loads from 0 to 60,000 pounds, the 
load does not have continuing oscillations, hunting or limit cycling in 
excess of 0.006 inch peak to peak position during a 10 second period. 

Hunting or long time drift during a one minute period does not exceed the 
threshold of 0.5 ma. 

Position loop gain adjustment - Provisions shall be incorporated 

into the actuator to allow adjustment of the position open loop gain (KvH) 

-1 -1 A 
from 12 sec minimum to 22.3 sec maximum. This gain adjustment 

mechanism should be field serviceable and should not have to be returned to 

the Vendor facility for installation. i 

Servovalve - The servovalves are of the flow control type utilizing 

mechanical feedback from the final stage to the first stage. External to 

the servovalve and removeable mechanics, hydraulic circuits are provided to 

i 

stabilize the reasonant load with bias loads up to 60,000 pounds as shown 1 
in Figure 4. 3. 5-2. Any additional steady state compliance due to these 
circuits is minimized. 

Power consumption - The power used by the servovalve torque motor 
with 50 ma applied shall be no greater than 0.3 watts at 77 degrees F. 

Actuator - The actuator is of the linear, double acting, equal 
area type with a net piston working area of 30 square inches. 

- - » - f t - r - ~*” T " ; *• 5 ' • * ' ‘ f i ~ ! j - -r ■ t i | 








FIGURE 4.3. 5-2 








' 
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. , 

SYSTEM PARAMETERS 


• 

SYMBOL UNITS 

VALUE 

DESCRIPTION 


KTM 

in-lb/ma 

* 

Torque motor gain. 


Kv 

ci s/in- lb 


Valve flow gain. 


A 

. 2 
i n 

30 

Piston area 


k t 

Lbs/in 

219000 

Total spring rate 


k l 

Lbs/ i n 

240000 

Spring rate - Structural tie points 


M 

k l = 

2 

Lbs/sec in 

KvH Sec ' 

A 

170.0 (Orbiter) 
22.30 

Engine equivalent mass 
Position. loop gain 


Kpl 

= (KvKTKp) 
“A2 

33 .6 Orbiter 

Pressure feedback open loop gain 


K p 

1 n- Ib/ps i 


Pressure feedback gain 


G P 


p s /p s +1 

Pressure feedback shaping network 

• 

T P 

H 

Sec 

1 n- lb/ i n 

1.0 Orbiter 

Time constant - Shaping network 
Position feedback gain 


<*v 

ci s 


Valve output flow 


Bi 

i n 


Ideal actuator piston position 


B P 

i n 

Max = 5.5 in. 

= 10.5 deg. 

Actuator piston position 


9 E 

i n 


Engine Posi tion 


1 c‘ 

MA 

No less than 
50 MA max 

Input command current 


Fd 

lbs 


External disturbance force 


f a 

lbs 


Actuator output force 


P 

psi 


Differential pressure 


Ps 

■ psi 

3000 

System Supply Pressure 


S 

sec - ' 

L 

Laplace operator 

• 
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Length and stroke - The length of the actuator is as specified in 
Figure 4. 3. 5-1. The maximum stroke shall be ±5.50 inches. (10% deg). The 
design allows for a minimum stroke of ±3.9" (±7%°) by the installation of 
a stroke limiting mechanism internal to the actuator. This stroke limiting 
mechanism may be field installed. 

Piston bypass valve - The piston bypass valve is manually operated, 
which when operated, relieves fluid locking of the piston. The valve is 
pressure actuated to close at a system pressure of 200 psig maximum. 

Lock - A removable mechanical lock capable of holding the actuator 
rigidly in its midstroke position is provided. The lock when properly 
adjusted establishes the reference midstroke position. 

Potentiometer - A linear, dual element, potentiometer with center 
taps is provided for actuator piston position indication. The potentiometer 
is internally mounted, directly coupled to the actuator rod. 

Stroke - The mechanical stroke of the potentiometer is 12.0 

i 

inches, including 0.025 inch of over travel at each end. The electrical 
stroke is 11.0 ± 0.02 inches. !' 

Electrical characteristics - The electrical characteristics are 
as shown irvJFigure 4.3. 5-6. The sum of the pading resistance, which is 
500 ±50 ohms, and the contact resistance is 575 ±125 ohms for each element 
as measured between wiper and element. The resistance between the center 
tap and the element is 150 ohms maximum for each element. 

Excitation - The excitation voltage of the potentiometer is 
60 ±0.25 vdc. 









SPECIFICATION 

THRUST VECTOR CONTROL FREQUENCY RESPONSE 

AMPLITUDE RATIO ~ B e /Bc = LOAD POSITION 

co^mo POSITION 



FREQUENCY ~ « z 



SPECIFICATION 

THRUST VECTOR CONTROL FREQUENCY RESPONSE 
PHASE SHIFT ~B a TO 8- 



FIGURE 4. 5. 3-4 


FREQUENCY 
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FORM 422-8 (VERTICAL) (NOVEMBER 1962) CONTINUATION SHEET 


REVISIONS 

SYM 

DESCRIPTION 

DATE 


BKNOi;;. ( 0) ' O'.: VlQlJp/ALEHT 


C Ci- 

I 

B o— ! — 

I 

A o — ! — 

I 

B o-|_ 

y °T' 
K ° -r ■ 

ii c, ! 

I 

r, o - : 

j 


7000 OHMS ±10% 

— -vWvVVVVWXAAAA/ 

--AAAA— »p’"! 

! Ur- EXT] 

—AAA,/' L 1 DII:E 

1. 4 


EXTEND 

DIRECTION 


AVvVVv')/\VvVAv 

7000 | OHI/S ± 10% 


NOTE: . . 

1. K OUTPUT VOLTAGE 
y° SUPPLY VOLTAGE 


-5.50 in 
f 



N 

O 

O / 



A 


: IP 


+5-50 in, 


,000 )N TKAVBL 
Fi'OM CEHYEE TAP 


A 


— ALLOV7AI5LE EREOE HAND 


FIGURE 4. 3. 5-6 
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4.3.7 RATIONALE 
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166 

Pages 3-55 thru 3-62 
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Pages 1 thru 33 

.20 

Pages IV-20 thru IV-21 

42 

All the document 
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4.4 REACTION CONTROL SUBSYSTEM 

The orbiter reaction control subsystem (RCS) consists of three self- 
contained monopropellant hydrazine propulsion subsystem modules installed ' 
as shown in FIGURE 4.4rl. The RCS provides attitude control and three- 
axis translational capability during both orbital and entry phases of the 
mission. The RCS may provide a backup for propellant acquisition during 
OMS engine operation. 

4.4.1 CONFIGURATION 


66 The RCS configuration employs 40 monopropellant thrusters 

operating at a rated vacuum thrust of 1000 pounds to provide a fail-operar 
tional /fail -safe attitude control and translation capability. Monopropel- 
lant hydrazine, stored in positive expulsion tanks, is used as the fuel. 
Tank pressurization is provided by regulated helium stored at ambient 
conditions. The RCS thrusters are installed in three independent re- 
— r -movable modules located in the orbiter nose section and in each of the 

! i I ; ■ J 

'< T ; aft OMS pods’. All thrusters, tanks, and components are completely inter- 

- • 

changeable in all modules. The forward module contains 16 thrusters; 
each aft module located in the OMS pod contains 12 thrusters. Manifold 

I | I i i } ! J i * 5 * r ■ <• • • : * i 

• isolation and purge valves provide multiple redundancy against’ loss of 
propellant in the event of a thruster valve open failure. Multiple 
redundant valves and regulators provide propellant tank pressure control. 

66 During docking operations, the forward RCS module thruster de- 
ployment panel is reoriented 45 degrees toward the closed position to 

preclude exhaust plume impingement on either the space station or a 
deployed payload. This automatically disables the normally upward firing 
thrusters and modifies the functions of the downward and outward firing 
thrusters to then provide the required maneuvering forces. In this 
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manner, all forward module plume centerlines are maintained at a minimum 
of 45 degrees from any potentially sensitive surface. 

166 The propellant storage and expulsion system uses the ethylene 

propylene terpolymer (EPT-10) diaphragm tank concept. 

166 The polar mission propellant requirement defines RCS 

•tank 'size and distribution between -fore and aft modules. Propellant 
quantities for the three reference missions are shown in TABLE 4.4-1., 

4.4.2- THRUSTER DESCRIPTION 

166 The RCS thrust chamber assembly uses a stand-off tube to minimize 

heat soak-back to the propellant valve. This valve is a fuel-operated 
valve controlled by an electrically operated valve. A cavitating venturi 
is incorporated in the valve, thereby providing constant fuel flow to the 
thruster and permitting performance evaluation based on monitored chamber 
pressure variation. This concept minimizes catalyst bed overloading at 
each pulse, thereby minimizing cold start problems. The injector assembly 
; consists of a body made of Hastelloy X with a low momentum Rigimesh 
injector design. The radial out-flow catalyst bed 

provides an increasing cross-sectional area to propellant flow, thereby 
minimizing the bed loading and decomposition gas velocities for maximum 
catalyst life. The inner section of the catalyst bed consists of 25 to 30 
mesh Shell 405 catalyst to initiate the decomposition of the N 2 H 4 . The 
outer section of the bed uses a coarse 14 to 18 mesh low-cost catalyst 
which improves the overall catalyst bed performance and life characteristics. 
The thrust chamber and nozzle are fabricated from a single Hastelloy B 
precision investment casting. An electrical heater (12 watts per thruster) 
is attached to the injector head and maintains a minimum catalyst bed 
temperature of 150° F to eliminate cold starts. 
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4.4.3 PROPELLANT TANKAGE 

166 A usable propellant capacity of 3130 pounds is provided in the 

forward module tanks, and a usable capacity of 1878 pounds is available 
in each of the aft modules. Five tanks are located in the forward module, 
and three are contained in each of the aft modules. Propellant tankage 
and lines are maintained within the acceptable operating regime by module 
thermal control. This is accomplished by electrical heaters (on-orbit) 
and insulation (on-orbit and entry). 

166 The propellant tankage system is designed to supply propellants 

to the thruster inlets at 290 psia minimum. Manual isolation valves are 
provided to isolate each tank assembly from the pressurization system if 
required. A manual disconnect is used to facilitate filling and draining 
the propellant tanks in each module. 

166 The RCS EPT-10 tank diaphragm is used to provide positive 

fuel expulsion during all operating conditions including zero g and re- 
. . . — en try. A capillar barrier at the outlet prevents diaphragm damage or 

i f i , 

pulgging of the propellant outlet port and permits most of the propellant 
to be expelled in the event of diaphragm failure. Tank diaphragm 

failures can be detected during turnaround by individually pressurizing 

; i [ _[•>• ; : : , : 

each tank, monitoring the flow from the propellant fill and drain dump 
fitting and sampling the helium pressurant. 

4.4.4 PRESSURIZATION SUBSYSTEM 

166 Four identical 4000 psi helium spheres provide the helium required 

for propellant tank pressurization. Two spheres are mounted in the for- 
ward RCS module, and one is contained in each of the two aft modules. The 
pressurization subsystem is designed to use primary and secondary regulators 
with operating bands of 310 to 325 and 320 to 335 psi, respectively, with 
a minimum 600 psia inlet pressure. Parallel pressure relief valves 
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designed to accommodate full helium flow (equivalent to four thrusters 
operating at steady-state conditions) are provided to limit propellant tank 
pressure to the design limit pressure of 435 psia. The pressure/volume/ 
temperature (PVT) propellant gauging system developed and used successfully 
on the Apollo CSM RCS will be employed in the orbiter RCS. 

Upon completion of RCS operations, purge isolation valves will be 
activated to provide a low-pressure helium purge to cool and decontaminate 
the thrusters. Post-landing operations will include thruster and valve 
assembly purge and drying with heated low-pressure nitrogen to ensure 
removal of residual propellants. 

4.4.5 RCS OPERATION 

The thruster engines receive firing commands from the Guidance, 
Navigation and Control computer or by indirect entry via manual translation 
or rotational hand controllers. Data from the RCS system is supplied to the 
onboard computer system for display to the crew of propellant and engine 
conditioning status. Electrical power and instrumentation conditioning for 
--’T/M is provided through redundant power systems. Manual crew controls are 
provided for control of activation and monitoring functions of the RCS 
operating ^system 

- --4.4.6— RATIONALE— — L — ! — j— r-~; — i- i— 

Not required 
4.4.7 REFERENCES 

166 pages 3-63 thru 3-68 
20 pages IV-20 thru IV-21 
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4.5 ORBITAL MANEUVERING SUBSYSTEM (OMS) 

The OMS provides the propulsive thrust to perform orbit circularization, 
orbit transfer, rendezvous, and deorbit. The OMS tankage is sized to provide 
propellant capacity for Mission 1, which retains a 65,000-pound payload throug 
out the mission. 

The OMS is capable of burning all of its allocated propellant in either 
a single long burn or a series of multiple burns spread at random over the 
mission duration. 

4.5.1 OMS CONFIGURATION 

The propellant quantity required for the design mission will be provide 
in two pods, one located on each side of the aft fuselage. Each pod contains 
high-pressure helium storage bottel , tank pressurization regulators and contro 
a fuel tank, an oxidizer tank, and a pressure-fed recket engine. The OMS 
employs nitrogne tetroxide (^0^) as the oxidizer and monomethyl hydrazine 
(MMH) as the fuel. Additional propellant storage is provided by three self- 
contained pressurant/propellant supply kits which maybe located in the cargo 
bay. The OMS AV/payload capability and the number of auxiliary OMS kits 
required are shown in FIGURE 4.5.1 as a function of the booster-MPS liftoff 
capability for’ the three design mission inclinations. 

Schematics of the basic subsystem and auxiliary subsystem are shown 
in FIGURE 4.5.1. Each pod system is fail -operational /fail -safe, except for 
the engine bi propellant valve, which is fail-safe. A pod crossfeed line, 
employed in conjunction with individual engine isolation valves, assures 
availability of all propellant for deorbit with the remaining single engine 
following a multiple failure in the bi propel! ant valve of one engine. 
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4.5.2 ENGINE 


66 The OMS engine is a 5,000-pound thrust reusable pressure-fed rocket 

engine. The nominal characteristics for this engine are listed in FIGURE 
4.5rl 


166 


166 


166 


The thrust chamber is regeneratively cooled using engine fuel flow 
with supplementary film-cooling. The coolant jacket extends aft from the 
injector to the radiation-cooled nozzle extension attach flange. The thrust 
chamber is fabricated of stainless steel. The injector is a flat-faced, 
nonbaffled design utilizing acoustic cavities to achieve dynamic combustion 
stability. The bipropellant engine valve is a series-parallel redundant 
valve with a pneumatic actuation package. The basic valve design is similar 
to that used in the Apollo CSM service propulsion subsystem engine valve, 
except for the use of a cam mechanism to lift the seals away from the ball 
prior to ball rotation, thus minimizing the amount of seal rubbing on the bal 
surface. 

The design uses the basic gimbal technique employed on the Apollo CSM 
service propulsion subsustem engine. Electro-mechanical actuators incorporat 
redundant drive mechanisms will be employed. 



P'ng 


4.5.3 TANKAGE 


The propellant and helium tanks are fabricated from 6A1-4V titanium 
alloy. The fuel and oxidizer tanks are identical and contain a maximum 
usable propellant load of 12,200 pounds per pod. The helium tanks will be 
identical to the Apollo CSM service propulsion subsystem helium tanks with 
a nominal servicing pressure of 3200 psia at 70°F. 
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Analysis indicates that lateral sloshing in the OMS tanks, which might 
occur during boost, does not represent a significant dynamic problem. Dynamic 
coupling of the sloshing forces and moments with the vehicle stabilization 
and flight controls can occur only at frequencies at which the disturbance 
torques generated are not significant. Therefore, the OMS propellant tanks 
do not have baffles. 

Liguid propellant will be retained in the engine supply lines through 
use of screened retention reservoirs containing devices to prevent premature 
surface dip and vapor ingestion at the tank outlets at propellant depletion. 
The reservoirs refill by hydrostatic vapor expulsion during OMS firings and 
require no auxiliary settling thrust. 

The auxiliary tankage and pressurization components located in the carg 
bay qre identical to hardware used in the OMS pods. Six propellant tanks (threi 
oxidizer and three fuel) and three helium tanks may be installed. A single 
pressurization control assembly is employed for the auxiliary tnakage. The 
auxiliary tankage kit is designed so that either one, two, or three sets of 
propellant and helium tanks can be installed as required by a particular missic 

Quantity gauging is provided during OMS engine firings by a set of 10 
dual point sensor assemblies. Quantity indications between point sensors, 
necessary for OMS status assessment, are provided by an integrating unit 
similar to the Apollo CSM service propulsion subsystem backup gauging system, 
using engine burn time and nominal propellant flow rates. Low-level warning 
is provided in each tank by an independent point sensor assembly. Backup 
and zero-gravity gauging is provided by pressure/volume/temperature type 
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gauging through use of the on-board performance monitor and CRT display. 

4.5.4 PRESSURIZATION 

The fuel and oxidizer tanks are pressurized through parallel flowpaths, 
thus eliminating the possibility of mixing fuel and oxidizer vapors coused 
by leakage and/or diffusion through the isolation check valves in the helium 
pressurization lines. Check valves are employed to prevent liquid propellant 
migration. 

4.5.5 INSTALLATION 

The OMS is installed in two removable pods with propellant crossfeed 

I 

lines that remain with the vehicle. The auxiliary tankage in the cargo bay 
also feeds propellant to the engines in each pod through the crossfeed lines. 

4.5.6 ENVIRONMENTAL CONTROL 

Thermal control for the OMS is provided by insulation and electric 
heaters to maintain the internal pod environment between 40° to 125°F on- 
orbit with a maximum of 150°F allowed as a result of entry heating. The insulation 
is installed to allow subsystem thermal isolation as a unit. This allows 
high heat capacitance elements to thermally stabilize the low mass elements. 

4.5.7 MAINTENANCE 

The engffle propellant isolation valve located between the tanks and the 
engine brpropellant valves provide for engine removal without purging of the 
propellant tanks. The engine valves also can be checked out with the engine 
installed and the tanks fully loaded . 

Manual shutoff valves installed upstream of the propellant tanks 
isolate the pressurization system from residual propellant vapor during 
ground operations. This valve also allows extensive checkout and replacement 
of pressurization system components without applying unnecessary pressure cycles 


oo 
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to the propellant tanks. The propellant tanks will be purged only when main- 
tenance or replacement of the tanks or associated components is required. The 
manual shutoff valve control will be designed so that the vent receptacle 
cover cannot be installed with the valve closed. 

4.5.8 OPERATIONS 

JIMS ,p.r.ef.l.fght .checkout ,and servicing is accomplished in the hypergolic 
serivicing facility. Following propellant servicing, the helium storage tanks 
and propellant tanks are then pressurized to 1,000 and 50 psig, respectively, 
to meet safety standards for normal working areas. The loaded pods are 
subsequently mated to the orbiter, after which the electrical and instrumental 
interface will be checked out with the tank and engine isolation valves 
closed. Final filling of the helium bottles will be accomplished at the 
launch pad. Auxiliary system checkout and servicing is identical to this 
procedure. An alternate capability will provide loading propellants at the 
launch pad after installation of the external pods and auxiliary system. 

The OMS is capable of operation at any time after launch, including 
simultaneous operation with the MPS engines. During all operating modes, 
the engines are normally fired simultaneously with the TVC maintaining parallel 
thrust vectors. During single-engine operation, the RCS will provide roll 
control . 

Auxiliary tankage propellant, when installed, will be consumed first. 
Propellant is retained in the pod tanks by closing the helium isolation valves 
in the pods. When a low-level warning is received from the auxiliary sump 
tank, the pod helium isolation valves are opened, and the auxiliary helium 
isolation, propellant isolation, and crossfeed valves are closed automatically 
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Following the deorbit burn, the engine propellant isolation valves are close< 
and the downstream propellant lines and engines are purged using residual 
helium. The engine valves remain open until just prior to reentry to vacuum- 
dry the purged assemblies and thereby remove remaining propellants and vapors. 
The engine valves are then closed to allow repressurization of the line 
upstream of the engine valves as a means of preventing air ingestion after 
entry. 

166 A dump system is provided for dumping OMS propellant in the horizontal 

flight condition. Residual propellants are dumped during entry following 
a normal mission; however, the system is sized to dump all OMS propellant in 
the pods prior to landing in the event of a low-altitude abort. For other 
abort modes, the OMS propellant will be burned through the engines. 




Figure 4.5^1 Orbit Maneuvering Subsystem Schematic 
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4.6 AIRBREATHING PROPULSION SUBSYSTEM (ABPS) 

The ABPS primary purpose is to provide loiter flight capability upon 
return from a space mission. With modifications, the ABPS also provides 
self-ferry capability from alternate landing sites to the launch site. 

The self-ferry configuration is used to conduct the horizontal flight 
test program. 

The orbital ABPS module, incorporating two engines, deployment 
mechanisms, a fuel tank, and supporting subsystems, may be installed 
in the aft section of the cargo bay. The weight of this module is 
charged against total payload capability; the module is removable for 
missions requiring maximum payload capability. The ferry system consists 
of the orbital module plus two additional engines, a ferry fuel tank, and 
supporting structure. A secondary electrical and hydralic power generation 
system is included in the ferry system. 

4.6.1 CONFIGURATION 

The orbital ABPS module consists of the structural, the engine/nacelle/ 
pylon, and the fuel tank assembly modules as shown in FIGURES 4.6.1. The 
vehicle scar weight associated with installation of the integrated module is 
that necessary for instrument and control wiring, vehicle structural "hard 
points," ferry mode vehicle power interface (hydraulic and electrical), and 
provisions for installation of the horizontal flight fuel fill and drain adapter. 
When the ABPS is installed, the two aft sections of the segmented cargo bay 
doors are removed. 


The structural module includes provisions to accommodate the orbiter 
structural interface, nacelle thrust and airloads, nacelle deployment, tank 
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166 mounting, and manipulator arm stowage. The nacelles are deployed by rotary 

motion about the nacelle pylon longitudinal axis using hydraulically driven 
power hinges. Segmented deployment doors actuated by linear hydraulic actuato 
remain closed throughout launch and orbital operations for environmental 
control purposes. The doors are automatically sequenced open during the 
depl oyment cycl e .and .are -then ..closed .following .engi ne ..depol.yment . 

166 Each nacelle module houses an afterburner turbofan engine modified 

to accommodate the predicted launch and orbital environment. The engine is 
a derivative of the Pratt and Whitney F401-PW-400 engine now under development 
Supporting subsystems include a dual element fire detection subsystem, a 
fire extinguishing sybsystem (dual bottle/dual shot per nacelle), electric 
thrust control subsystem, an air start assist system, and a thermal control 
system. The electric thrust control subsystem is an adaptation from the 
concept being developed under the B-l program with minor modifications 
required for engine and cockpit quadrant arrangement differences. A cartridge 
air start system is proposed with either cartridge or pneumatic capability 
provided for ground starts. 

4.6.2 FUEL TANK 

166 The fuel tank module includes a main fuel tank and the associated tank- 

mounted units of boost pumps, shutoff valves, vent valves, quantity gauging, 
and thermal control provisions. The tank may contain 22,565 pounds of fuel 
for the early orbital development flights. For operational flights with 
scientific payload, this tank will be off-loaded to the 13,681-pound quantity 
required for engine air-starting and 15 minutes of loiter flight at 10,000 feetj 
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166 Tank fuel flow is provided by three electrically driven "plug-in" 

type boost pumps supplying a common maniford that connects to both engine 
nacelles. An atmospheric air-venting system is provided that uses series/ 
parallel vent valves to maintain on-orbit tank pressurization and fuel 
isolation. Refuel ing-defueling capability and capacitance gauging systems 
^ane .prav.tded -for both ,the , vertical .and horizontal .vehicle attitude. Dual 
level control valves are employed for capacity control in either attitude. 

166 The thermal control subsystem employs electric heaters and insulation 

to maintain the bulk fuel, the engine, and support subsystems (starters, fire 
extinguishing, thrust control, lube oil, etc.) within design temperature 
limits. A steady-state temperature range of — 65^ to 275°F is specified for 
the engine with a — 350°F limit on transients; the lube oil in the storage 
tank is limited to — 25°F minimum; and a range of — 30°F to +160°F is stipulated 
for the fuel. 

4.6.3 FERRY CONFIGURATION 

166 To provide the required ferry thrust, two additional F401-PW-400 

engine nacelle assemblies are installed in a fixed position on the ABPS 
structural module lower shoulder. The vehicle APU system will not be used 
for power generation during ferry or horizontal flight test operations; 

‘ therefore, a secondary power generation kit providing hydraulic and 400-Hz 

electrical power capability will be installed and driven by each of the four 
engines. An uninsulated ferry tank will be installed aft of the orbital 
fuel tank to accommodate an additional 44,905 pounds of fuel. This capacity 
was selected to provide maximum fuel (67,470 pounds) for flight test up to 
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Figure 4.6-1 



A BPS Configuration 
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the vehicle gross weight limit of 232,000 pounds. Capacitance gauging and 
single point refueling provisions will be provided for the ferry tank in the 
horizontal attitude only. The ferry tank will be off-loaded to provide a 
total fuel loading of 52,000 pounds for the 400-nm ferry range capability. 
4.6.4 OPERATION 

The,* ABES .i s ...purged of .all .fuel and lube oils prior to orbital flight. 
This is- necessary since in orbit the engines encounter vacuum environment. 

The vehicle uses pneumatic helium pressure for the main propellant 
and engine valve activation, engine pump seals, purging and inerting all 
propulsion lines, engines land fuel tank prepressurization. 

Operationally, the ABPS remains inactive until reentry except for 
thermal control system functions. After entry, the nacelles are deployed, 
and the engine oil and fuel systems are primed. For early development 
flights, assisted air starts will be initiated at 40,000 feet- the upper 
limit of the air-start envelope. The design fuel load for operational flights 
is based on delaying air start initiation to 25,000 feet, which will provide 
sufficient time during descent for engine start and operational check prior 
to initiating the planned 15-minute loiter flight at 10,000 feet altitude. 

The APES engine is provided with a manual power lever to control the 
engine thrust from IDLE to maximum. Below the IDLE position the power lever 
will actuate fuel cutoff valves. 

Control of all engine operations is initiated by crew members. Engine 
thrust level is governed by a fuel controller. The fuel controller combines 
input signals from the throttle lever position, engine RPM sensor, compressor 


< 
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inlet temperature and pressure sensors, and the compressor discharge pressure 
sensor to position the fuel metering valve. 

Instrumentation monitoring is required on fuel flow rates, temperatures 
pressure; turbine inlet and exhaust temperatures; valve state; lubricating oil 
quantity, pressure and temperature; and burner pressure. 

The Caution and Warning System is provided inputs from the ABES system 
during ferry flights and the re-entry flight when activated by crew members. 

4.6.5 RATIONAL for ASSUMPTIONS 

A. Throttle controls for the APESare visible on instrument panel 
configurations, however, detailed descriptions are not yet available. 

B. Reference 36, page 4-673 indicates APES instrumentation by 
quantity of measurements only. At present it is assummed these measurements 
pertain to standard turbofan parameters monitored in existing aircraft. 

Also since the engine is deployable, it is also assummed there are indications 
presented to the crew for the condition of engine deployed. 

C. There is no reference detailed to the level of components of 
systems for the APES. It is assummed the APESis manually controlled, i.e. 

no computer throttle control and that the turbofan engine has a fuel controlle 
similar to ^standard aircraft. 

D. There is no reference to date of interfaces of the Caution and 
Warning System, however, this interface is required for operation. 

4.6.6 REFERENCES * 

20 pages IV-20 to IV-21 

166 pages 3-75 to 3-80 
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4.7 SOLID ROCKET MOTORS 


66 


66 


166 


66 


The shuttle vehicle is equipped with 156" solid rocket motors (SRM) 
providing thrust forces for main vehicle liftoff, shuttle vehicle abort separat 
and external tank retro-deorbiting. Each of these engine groups is discussed 
in detail in the following paragraphs. 


on 


4.7.1 MAIN SRM 


Two 156- inch diameter SRM's are attached to the orbiter external tank 
and burn in parallel with the orbiter MPS engines to provide ascent propulsive 
thrust up to staging. In addition to the rocket motors, the booster assembly 
contains an aft skirt launch support structure, forward skirt and external tank 
attach structure, separation rocket motors, recovery system, aerodynamic 
fairing, an electrical power and distribution system, and a malfunction detec- 
tion instrumentation system. 

The SRM assemblies transmit thrust through a structural skirt at the 
forward end of the motor into the external tank subsystem intertank structure. 
Total vehicle support on the launch pad is provided by structural skirts on 
the aft end of the motors. The motor nozzels are fixed at a cant angle of 
11 degrees to the motor centerline in the yaw plane. Thrust termination 
ports are provided in the forward end of the motors for use under abort 
conditions. FIGURE 4. 7. 1.1 shows a baseline motor envelope, while preliminary 
motor characteristics are presented in FIGURE 4. 7. 1.2. 

A segmented case design was selected to afford a maximum degree 
of flexibility in selecting a fabrication site and for ease of transportation 
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and handling. The motor nozzle uses a composite ablative inner liner and stee 
outer shell with provisions for attachment to the motor case aft closure. 

Each SRM composed of polybutadiene acrylonitrile (PBAN) provides an 
initial sea-level thrust of approximately 3.52 million pounds. The motor 
ballistic provides a high initial thrust/weight with decreasing thrust to 
. .11 tnit unaxi mum .q followed by an increasing thrust to minimize g loss while 
maintaining vehicle acceleration below the 3-g limit. Predicted ballistics foi[ 
a motor using proven propellant grain geometries were used for trajectory 
analysis, FIGURE 4. 7. 1.2. 

A conventional self-contained pyrogen ignition system with appropriate 
redundancies and safe and arm provisions will be utilized. Final selection 
of initiator type (exploding bridgewire versus hot wire) will be based on 
an assessment of overall Shuttle system ordinance requirements. 

Thrust termination is provided for abort modes by means of two symetribal 
blowout ports formed in each forward motor by the ignition of linear 
shaped charges (FIGURE 4. 7. 1.3). Exhaust stacks are provided to direct the 
gas discharge through the forward attach structure and away from the orbiter. 

The stacks also provide some gas expansion to achieve slightly higher thrust. 

The ports are sized to provide approximately 10 percent positive SRM net thrust 
throughout all, phases of burning to enhance separation. A malfunction detection 
system is used in conjunction with the thrust termination system to provide 
an early warning of an impending catastrophic SRM failure. As a minimum, the 
system will contain pressure and temperature sensors to detect abnormal pressurjes 
and/or overheating conditions. 
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166 The SRM/external tank subsystem separation system (FIGURE 4. 7. 1.4) 

171 operates in normal and abort modes at varying SRM residual thrust levels and 
oblique vehicle flight paths. The SRM separation system uses auxiliary 
rockets to provide relative separating motion between the SRM cases and the 
orbi ter/tank. Forward and aft recket thrusters provide the desired separation 
.^rao&cto.ry,, .while the aft thrusters are rotated to counter any SRM residual 
thrust. The thrusters are located to minimize plume impingement on the orbiter. 
, This system prevents reaction loading on the external tank subsystem. Three 

| rockets are located forward and three aft to provide safe separation with 

i 

single rocket failure for normal staging (F vac — 27K pounds, t^ — 2 

avg 

seconds). The aft separation rockets are installed at a greater angle than 
forward rockets to account for residual thrust of skewed main rocket nozzle. 










! 




F igur e 4.7.1- 2c SRM Thrust Time Profile and Characteristics 
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4.7.2 ABORT SOLID ROCKET MOTOR (ASRM) 

The abort solid rocket motor subsystem, consisting of two solid rocket 
motors attached to the orbiter aft fuselage, provides the rapid start and high 
thrust necessary to successfully accomplish orbiter separation from the booste 
SRM's and external tank subsystem in the event of an abort between 0 and 30 
seconds from liftoff. 

In an aborted mission the abort rocket motors are fired simultaneous!}], 
reaching peak thrust in 600 milliseconds, and burn for approximately 21 seconcs 
with an average thrust of 385,000 pounds. The predicted thrust-time history 
is shown in FIGURE 4.7.2. 1 At ignition, a 2.45 thrust/weight ratio is provided 
to accelerate the orbiter (with 65,000 pounds payload) away from the booster 
and external tank. After burnout, at approximately 12,000-foot altitude, the 
abort solid rocket motors are jettisoned. In a normal mission, the motors are] 
jettisoned unused 30 seconds from liftoff. 

The ASRM's are separated during a nominal mission (unused) or following 
an abort firing (expended). The nominal separation is accomplished by placing 
the SRM's at the rear of the configuration so that a simple release mechanism 
allows the vehicle to accelerate away. The nominal acceleration at this poi nt| 
in this trajectory gives adequate separation safety margins. The ASRM's will 
land approximately two nm downrange. The more difficult ASRM separation probl 
occurs when the abort rockets have fired to separate and maneuver the orbiter 
away from the tank and booster. For orbiter stability reasons, the ASRM's are 
separated immediately after burnout with the orbiter and ASRM's experiencing 
deceleration forces. 


en 
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The abort solid rocket motors require separation under two conditions 

of aerodynamic loading and mass. In a normal mission, the unused abort solid 

rocket motors are jettisoned at a dynamic pressure of 300 to 400 lb/ft , which 

provides separation forces in an upward and outward direction with respect to 

the orbiter. In an abort mode, the motor weight is 8,100 pounds at burnout 

2 

..and .the k dynamic. J pressuKe. i is.7.00-«to-.»800-lb/f<t . Relative acceleration studies 
indicate complete separation and clearance between the abort solid rocket motors 
and orbiter in less than 1 second. Bolt-on fittings are provided to meet 
orbiter maintenance time schedule. Separation occurs at the clamp thrust 
interface, leaving only the attachment fittings on the orbiter. These fittings 
will be structurally loaded during orbiter structural testing. A triple 
redundant explosive separation clamp sized for worse-case conditions will assure 
separation. 
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4.7.3 DEORBIT SRM FOR EXTERNAL TANK (ET) 

Deorbit of the ET requires a 300-fps retrograde velocity increment to 
effect ET fragment impact in the prescribed footprint in the Indian Ocean. 

This A V is achieved with a forward -firing solid rocket motor installed in the 
ET forward fairing and firing through a fragible nose cap. The motor is armed 
’*and -f4r^d,Jby-4ihe-ET^a^on4.Gs -.ba^tery/sequenc-er subsystem ’following ET-orbi ter 
separation. The deorbit motor design, as dictated by theAV requirement, has 
an average vacuum thrust of 18,500 pounds and provides a total impulse of 
approximately 686,000 lb-sec during its 37-second burn time. The preliminary mot|) 
design is approximately 37 inches in diameter, 76 inches in length, and has 
a total loaded weight of 2,600 pounds. The configuration contains 2,400 
pounds of propellant and is based upon the modification (5-percent increase 
in propellant quantity) of an existing spaceflight-qualified rocket motor. 


r ‘ 


Table 4. 7. 3.1 DEORBIT SRM VACUUM PERFORMANCE 


Thrust Avg. 

18 , 500 lb . 

Thrust Max 

21,000 lb. 

Burn Time Avg. 

37.1 sec 

Total Impulse 

686,350 lb. -sec. 

Specific Impulse 

286.5 sec. 

Pc Avg . 

520 PSIA 

Nozzle Area Ratio 

40 

Throat Area 

19.35 in, 

Throat Dia . 

4.95 in. 

Exit Dia. I.D. 

31.2 in. 

Cf 

1.837 

If 

1.18 

Case Dia. 

37 in. • 

Length , Overall 

75 3 in. 

Wt . Loaded 

2,610 lb. 

Propellant Wt . 

2,400 lb. 

Burnout Wt . 

210 lb. 



The relative location of the ET Deorbit SRM is shown in FIGURE 4. 7. 3.1 


10/20/72 



Space Division 

North American Rockwell 


4-125 



q 

bO 

•r-< 

W 

<D 

Q 

q 

ni 

H 


ni 

q 

u 

<1> 

X 

W 


<U I 
U CO 
3 • 

60 

•H • 


2-63 


SD 72 -SII-75 




DATE 


REV. 


10/20/72 


THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

BINGHAMTON. NEW YORK 


PAGE NO. 


REP. NO. 


At 126 


4.7.4 RATIONAL 


Not required 
4.7.5 REFERENCES 

166 Pages 3-151 to 3-153 
171 Pages 2-59to 2-66 





10/20/72 



Space Division 
North American Rockwell 


4-127 


allow a 15 -percent-over-mission load condition on the 
^^ding system by increasing the main gear tire pressure 
to 250 psi and maintaining static tire deflection at 32 


percent. The ferry/horizontal flight test condition pro- 
vides the design criteria for the maximum tire load 
caused by the down-load due to elevon deflection for 
nose wheel liftoff. Main gear tire deflection at this con- 
dition is approximately 50 percent. The ferry condition 
also defines the criteria for turnover, spacing, and struc- 
tural sideload caused by turns during taxiing. When 
designed to these conditions, the landing system is cap- 
able of drift landings with peak ground wind speeds 
to 35 knots from any azimuth. 

Additional cost savings during the implementation 
and operational phases of the orbiter results from 
landing/deceleration system maintainability and servic- 
ing features. The main gear, nose gears, and deceleration 
chute are fully accessible for structural and system in- 
spections and servicing by access through the gear doors 
and vertical stabilizer speed brake. Using standard 
access equipment, the main and nose gears can easily 
be inspected in the preventive maintenance apportion- 
ment time of 2.25 hours. With the speed brake open, 

« deceleration parachute backup structure is exposed 
can be inspected visually within 0.50 hour. In order 
to meet the allocated hours for servicing, the decelera- 
tion chute is a module package which, for installation, 
requires only mechanical and electrical connecting. 
Gear lubrication and main and nose gear shock strut 
service is also accomplished through the open gear 
doors. Jacking provisions are provided at each strut 
to accommodate wheel/tire replacement, without re- 
moval of other components, in 1.2 hours. The main 
gear brakes are replaceable as a unit, are open on the 
upper aft side for ease of inspection,' 'and can be replaced 
within the allocated maintenance time. 

Tow attachments to allow towing on slopes to 5 per- 
cent are provided on the front and rear of each gear, 
and are positioned to prevent towjng equipment inter- 
ference. 

During the development of the landing and decel- 
eration system, full consideration will be given to meet- 
ing the orbiter maintainability and turnaround time 
requirements, discussed further in Section 2.4. 

SD will define, develop, certify, and deliver, for the 
orbiter a landing and deceleration system which pro- 

• ■s for all phases of shuttle operations. This results in 
t minimum launch, wfight. impact and\ sirn pk’Sv; direct 
acting ^v^ern. fvs't’.n-T ccvMProcnt pos c *Mc' 
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The use of existing equipment requires on-orbit con- 
ditioning of the main and nose gear wheel wells to 
maintain the exposure temperature within — 60 °F to 
275 °F. This is accomplished by use of a combination of 
electric heaters and passive insulation, described in 
Section 3.1.3. Deceleration parachute thermal protec- 
tion also is described. The landing/deceleration system 
will be developed and space-rated by conducting 
environmental testing where necessary. Certification 
by similarity to existing hardware will provide cost 
savings to the program. Thermal vacuum testing of 
nonmetallic components, such as tires and lubricants, 
is proposed. Landing gear simulators are proposed for 
the conduct of operational and endurance tests. Static 
ultimate load and fatigue tests will be conducted as 
part of the structural test program. Final qualification 
testing of the deceleration chute, nose gear steering, 
and brake systems will be accomplished during taxi as 
part of the horizontal flight test program. The landing 
system test requirements and program are discussed in 
detail in Volume 5. 

The orbiter mission will expose landing system com- 
ponents to long-term space environment for the first 
time, requiring space rating of this equipment. SD will 
apply its Apollo CSM experience and analysis capability 
on long-term space environmental exposure affects to 
• the development of certified equipment and to a rea- 
sonable certification program. 

The landing/deceleration system proposed is based 
on the Phase B study. No problem areas not previously 
solved by SD on Apollo CSM or by NR on its many 
aircraft systems are anticipated. 

3,1.3 THERMAL PROTECTION AND 
CONTROL (WBS 1.3.1. 3) 

The thermal protection and control system consists 
of two elements. One, the thermal protection system 
(TPS), is external to the primary structural shell of 
the vehicle. It maintains the airframe outer skin 
within acceptable temperature limits during the vehicle 
mission. Where internal vehicle special compartments 
or areas require additional thermal control, the external 
TPS is augmented by a second element; the internal 
thermal cpntrol system (TCS). Overall .vehicle thermal 
design also is included in the ECLSS, discussed in Sec- 
tion 3-5, the purge and. vent subsystem, discussed in ... 
.•r.-.SecttQn .3;1.T.5 ; ' and other. 'sui>sy stems. TPS and TCS'-'-. ■- 

*ii’c ui^ilobi'U HI utia bU'CClOil. 
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3.1. 3.1 TPS DESCRIPTION AND FEATURES 

The baseline TPS (FIGURE 3-25) consists of: (1) 
ceramic reusable surface insulation (CRSI) (ceramic 
panels with an external waterproof coating on a strain- 
isolation foam pad) directly bonded to the airframe in 
areas exposed ro surface temperature between 650 °F 
and 2500°F; (2) elastomeric reusable surface insula- 
tion (ERSI) directly bonded to the airframe in areas 
exposed to temperatures below 650°F, and (3) rein- 
forced carbon-carbon (RCC) material in the wing 
leading edge and body nose cap in areas exposed to 
'temperatures’ above' 2500°F. 

3.1. 3.2 CERAMIC RSI. 

Candidate ceramic insulation material systems 
basically consist of mullite or silica. SD’s rationale 
supporting the use of mullite as the baseline TPS 
material is presented in the Discussion Item 2 re- 
sponse. SD plans to review the RSI material candidates 
after ATP and make the final selection by PRR. Four 
basic elements of the mullite CRSI system are reviewed 
as follows: 

• Mullite panels — A low-density insulative com- 
posite material formed by coating a matrix of 
mullite fibers rigidized with an aluminum-boria 
silica refractory glass binder. The panel and pad 
(FIGURE 3-25) dimensions are determined by 
the thermal/structural analyses 

® PD-200 pad — A chemically foamed methyl- 
phenyl silicone elastomeric material. This pad pro- 
vides strain isolation of the CRSI from the alumi- 
num structure and accommodates local surface 
irregularities. Its outer surface design temperature 
is 650°F, determined by the allowable bond tem- 
perature. The inner surface design temperature is 
350°F. This temperature was selected to yield the 
lowest TPS and aluminum primary structural 
weight. Early analyses indicate that by increasing 
the bottom and chine pad thickness by 0.2 inch, 
the ablative characteristics will provide a ceramic 
panel loss fail safe entry. This will be substantiated 
by further analyses and tests. 

• SR-2 coating — A waterproof ceramic coating 
fired at 2500 "F on the top and sides of the panel. 
This coating is chemically compatible with and 
similar in expansion coefficient to the mullite in- 
sulation. The coating provides the necessary 
thermal control optical characteristics, rain erosion 
'protection, ■ and abrasion • resistance ;£oif ground: 
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handling and atmospheric flight. 

• RTV-560 adhesive — A silicone elastomer room- 
temperature-cured adhesive system used for both 
panel and pad bonding. 

The RSI system is structurally sized considering the 
effects of airframe structure with a general thermal/ 
structural analysis method for multi-material ortho- 
tropic elastic bodies. It is based on finite element, direct ' 
stiffness methods for computing displacement stresses 
and strains thru the substructure adhesive, pad, panel, 
and coating. This analytical technique has been verified 
„and -correlated with test results. 

Panel-to-panel gaps (0.12 to 0.25 inch) are sized to 
avoid CRSI panel compressive loads at maximum ex- 
pansion during entry. The gaps are partially filled with 
a low-density-quartz expandable gasket to thermally 
protect the substructure at the base of the joint. The 
height of the gasket is determined by thermal analysis 
to preclude material thermal degradation. A panel self- 
venting system is provided which allows venting to the 
boundary layer pressure through the panel gaps. It 
consists of a local interruption in the panel to PD-200 
bond line (adjacent to the panel lower outer edge.) A 
silicone primer, applied to the lower panel surface, 
provides a water barrier while allowing venting of in- 
ternal gases. This venting concept has been test-verified. 
Two CRSI test prototypes, mounted on simulated air- 
frame structure and configured to two critical areas of 
the baseline system, have been successfully tested to 
withstand 100 orbiter thermal environment cycles. Dur- 
ing the test series the prototypes were also subjected to 
a dynamic/acoustic energy spectrum of 163 db for the 
equivalent of 25 missions. See Section 2.2.4 for dy- 
namic acoustic design requirements. 

3. 1.3.3 ELASTOMERIC RSI 

An important feature is the use of an ERSI 
(ESMI004X) as the primary TPS on the orbiter upper 
surfaces where lower temperatures (<650°F) are ex- 
perienced. Using an elastomer instead of a ceramic re- 
sults in a TPS weight reduction of 3500 pounds. It is a 
flexible, open-cell structure material possessing good 
low-temperature flexural properties, and is attached to 
the airframe in coated sheets with RTV-560 bond. The 
ESM1004X is coated with an elastomeric silicone resin 
(for waterproofing) pigmented with titanium dioxide 
' and carbon black (for thermal control). It is an impact- 
resistant, easily repairable material which will minimize 
•the' s usee p tab! 1 i ry'. fo handling. damage. " 
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4.8 External Tank Subsystem (ET) 

The ET is a single assembly with integrated L0 2 and LH^ tankage and structure. 
The ET is mounted in parallel below the orbiter and between the two SRM booster 
The configuration consists of structure, thermal protection system, main pro- 
pulsion system tankage components, avionics, and mechanical components (Figure 
4.8-1). 

4.8.1 Structure 

The ET structural design is illustrated in Figure 4.8-1. Both propellant 
tanks are constructed of 2219 aluminum monocoque skins with support frames. 
The design employs explosive bulge forming to form the individual bulkhead/ 
cone gores. The skins and frames are butt fusion-welded together to provide 
reliable sealed joints. 


The LO^ tank aft skirt and the LH^ tank forward and aft skirts use 2024 
integral machine-milled skin/stringer structure stabilized with attached 
hydro- formed and chem-milled frames. 

The ET to orbiter structural attachment (Figure 4.8-2) consists of one forwar 
and two rear connections, through truss structures mounted to the LH 2 tank 

^ i 

support frames and longerons. The mechanical release components are installer 
in the orbiter. The attachment between the ET and each SRM booster consists 
of one forward ball joint connection at the intertank longeron /frame juncture 
plus two links and a slide at the LH 2 tank aft skirt frame. 

A field joint is provided at the intertank skirts by circumferential tension 
bolts. This joint provides tank assembly and tank shipment benefits. 

Doors in the forward fairing and the L0 2 tank aft skirt provide access to 
interior installed equipment. In addition, manhole doors in each tank 
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166 provide manufacturing and field operations access for installing and 

maintaining equipment installed within the tank. 

166 Saturn S-II type linear pyrotechnic explosive is installed along the sides 

of each tank for range safety propellant dispersion. 

166 The ET is axially supported aft of the L0 2 tank by attachment of the canted 

SRM booster thrust cones to the ET ball joints on the intertank pitch axis. 

4.8.2 Thermal Protection System (TPS) 

166 Spray-on foam insulation (SOFI) is applied to the complete outer surface of 

the LH 2 tank, including the sidewalls and the end bulkheads. Sheet cork 
and the other high-density ablators are bonded directly to the outer surface 

I of local structural areas (Figure 4.8-3). Sheet cork ablator is also bonded 

to a fiberglass substructure that is locally supported from the LH 2 tank af : 
bulkhead. The TPS coverage is minimized by using the heat sink provided by 
the ET sidewalls, SOFI, and propellants. 

. i 

4.8.3 Deorbit Motor 

166 Deorbit of the ET requires a 300-fps retrograde velocity increment to effec; 

ET fragment impact in the prescribed footprint in the Indian Ocean. This 
is achieved with a forward- fi ring solid rocket motor installed in the ET 
forward fairing and firing through a frangible nose cap. The motor is armed 
and fired by the ET avionics battery/sequencer subsystem following ET/ 
orbiter separation. The deorbit motor has an average vacuum thrust of 18,5(0 
pounds and provides a total impulse of approximately 686,000 lb-sec during 
its 37-second burn time. The motor design is 37 inches in diameter, 76 indes 
in length, and has a total loaded weigh-t of 2600 pounds. The configuration 
contains 2400 pounds of propellant. ... 
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4.8.4 Avionics . 

166 The ET installed avionics consist of two redundant primary batteries, 

sequencers and range safety receiver/decoders and antennas, development 
and operational flight instrumentation , and all interconnecting harnesses. 

4. 8. 4.1 Instrumentation 

166 The instrumentation used for propellant loading and tank pressure control 

during the mission consists of pressure transducers, temperature trans- 
ducers, and liquid level sensors. Quad- redundant sensors are used 
throughout except for the optical type liquid level point sensors. The 
latter are mounted at the following volumetric levels at the walls in 
each tank: 2%, 3%, 10%, 20%, 30%, 40%, 50%, 60%, 70%, 80%, 90%, 97%, 

98%, 99%, and 101% - with four sensors each located at the 1% and 100% 
levels. The 100% level is defined as the rated propellant load volume - 
exclusive of the 3% ullage volume. These sensors will be used during the 
fill operation to control the propellant fill rate. The liquid level 
sensors are used as part of the propellant utilization control system 
working in conjunction with engine controls. 


Optical type liquid level point sensors located in the feed lines are 
used as control sensors during the and LO 2 dump sequencing. These 
sensors are referred to as depletion sensors. 


< 


Tank pressure will be controlled to within + 1.5 psi of the desired leve 
during each phase of the mission by means of pressure control units locatejd 
on the vehicle. After orbiter engine shutdown, these units will control 
the dumping of liquid residuals and will vent the tanks to 5 psi prior to 
separation. 
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4. 8. 4. 2 SEPARATION 

166 Since there is no communications link between orbiter and tank after 

separation, a simple combination timer, distance calculator, and attitude 
and attitude rate measuring unit is installed in the tank. This unit 
generates the signal to fire the retrorocket under normal operation mode 
and delays this signal in case .of .a malfunction where the distance/ 
attitude condition for a normal firing time could create a hazard to the 
orbiter. It also generates the sequencing signals for the tumbling- 
enforcing jet system. 

The geometric relations between orbiter and tank deploy tapes which remain 
attached to the orbiter during the separation maneuver and the relative 
velocity of their ejection from the tapereel tank provide for the direct 
determination of distances, attitude, and attitude rates. 

The ET ordnance timing system performs the sequencing function which 
accomplishes retrorocket ignition. Prior to separation all power, contrcl, 
and system monitor functions come from and are located in the orbiter. 

The post-separation system is fully autonomous (including its own power 
supply). 

4. 8. 4. 2.1 Electrical Power 

166 No separate power system is required in the ET during operation up to 

separation. All power up to 2 sec prior to separation, and the power 

! 

! requirements for the ordnance system operation after separation are 

satisfied by its own batteries. The only additional requirement remaining 
after separation is for the operation of the timer/separation condition 
sensor unit. This low power requirement is provided by two dedicated 
batteries incorporated in the ET system. 
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66 Figure 4.8-4 illustrates the system to provide a separation sequence 

that accommodates both perpendicular and axial separation trajectories 
and meets all modes of separation from pad-abort to nominal mission 
orbital separation. Through use of the orbiter's existing ACPS (for 
orbital separation) and aerodynamic forces (for suborbital separation) 
no other .active displacement system is required for ET separation any- 



where in the mission. 

4. 8. 4. 2. 2 Interface 

Orbiter/ET interfaces requiring separation are grouped in two subsystems 
(L0 2 and LH^) and three structural disconnect mechanisms. All of the 
subsystem's propellant transfer disconnects are composed of linear 
actuated poppet valves attached to umbilical plates on both the ET and 
orbiter sides of the interfaces. As the umbilical plates separate, the 
poppets are closed when the valves are disconnected. Because of differen- 
tial motion between the ET, orbiter, and propellant lines resulting from 
thermal structural deflections, there is no rigid tie between the ET's 
umbilical and the ET. Retracting bungees are installed between the ET 
and its umbilical plates to retract and retain the ET's umbilical plates 
after release from the orbiter. Electrical plugs and receptacles are 
likewise attached to, and separated by, the orbiter and ET umbilical 
plates. 

Three structural interfaces are arranged in a triangular pattern with two 
thrust interfaces aft. Side loads are reacted only at the left aft and 
forward attachments. All three interfaces react vertical loads. The 
geometry of the aft interfaces are such that the orbiter's MPS thrust 
forces are transferred to the ET by canted links approximately aligned 
with the MPS thrust axis. The forward structural attachment is comprised 
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166 of an A-frame truss canting aft from the ET with its apex having a pivotei 

shallow probe engaging a socket within the orbiter's lower mold-line. A 
stud within the probe engages jaws of a restraining latch attached to the 
orbiter. The canted links provide controlled displacement of the orbiter 
away from the ET during pad-abort. Perpendicular (orbital and suborbital 
"ET separation 'is readily accommodated. Mechanically actuated doors will 
subsequently cover all of the orbiter's aft ET interfaces. The forward 
interface will have a heat-sink and therefore will not require a door 
1 cover. 

4.8.5 RATIONALE FOR ASSUMPTIONS 
Not required 

4.8.6 REFERENCES 

166 - Pages 3-151 thru 3-154 






Figure 4.8-1 , External Tank Designed for Low Cost 
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Figure 4.8-2 


External Tank Load Distribution 
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Figure 4.8-3 


External Tank Thermal Protection 
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4.9 Guidance, Navigation, and Control (less computer) 


1 


2 


1 


3 



The shuttle flight control system, given guidance commands 
and data on vehicle dynamics from sensors, provides RCS firing commands, 

0MS gimbal actuator commands, MPS gimbal actuator commands, and aero- 
surface actuator commands. The flight control system is divided into 
primary and backup control systems. The primary GN&C subsystem 
provides control for all flight phases, with both automatic and manual 
modes. The primary system is present in three redundant strings, inter- 
connected only at I MU output and output force servos and jet drivers. 

During quiescent on-orbit periods, only one string is used. Flight 
control loops used with the main engine TVC, 0MS TVC, and the RCS are 
closed through the GN&C computer. Aerosurface control uses the computer 
and the Aerodynamic Stability Augmentation System. (ASAS) An additional 
manual aerodynamic control mode bypasses the computer and uses only 
the ASAS. The ASAS is an F-14 type conventional analog system which ; ; 

employs body mounted rate gyros and accelerometers. Gain scheduling is 
provided by inputs from an air data system. The entry and approach/ 

i i * s i • • ' * I . - I I f • : ! : 

landing primary control systems are illustrated on the foil owing page: — 
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Figure 2-92. Entry Primary Flight Control Systei 


■stem 


i i 


MANUAL TRIM - 


"t — r 



=@~b -;;v t -€ 

■.ERATiON— 4{^)- 1 


MANUAL TRIM - 


lateral 
ACCELERATION 
COMMAND 




I \/~ . m manuai 

'\yrrnj — * 


ANGLE Of ATTACK 



Figure 2-97. Approach/ Landing Primary Flight Control 
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The load relief control scheme used during periods of high dynamic 
pressure during boost uses both main engine TVC and aerosurface 
control. It is illustrated below: 
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On-orbit (non-thrusting) flight control effects attitude and trans- 
lation maneuvers using RCS jets. Cross-axis coupling is eliminated 
RCS jet select logic. Key features are: 

1. independently selectable three-axis hold capable of 


by 


a'cc'ep'ting 'guidance commands. 

2. independently selected three-axis translation control 

3. selectable attitude accuracies of + 0.5, + 10, and + 45 degrees, 
and minimum attitude rate of 0.1 

sec 

4. minimum overshoot response to commanded inputs provided by rate 
feedback, and RCS select logic providing minimum propellant consumption 
and inhibiting opposing jet firings. 

Attitude control during 0MS firing is achieved by gimballing the 0MS 
engines. In the case of single 0MS engine operation, RCS will provide 
roll control. 

A backup GN&C subsystem is provided, which provides safe return capabi 1 i ty 
for all flight phases. It is separate from the primary subsystem, using 
dedicated censors and electronics. Backup control inputs are manual. 
Control modes are summarized below: i ' >. I ! 


Mode 

Flipt Phase 

Characteristic 

Command 

• Boost/Insertion !TVC ! Orbital rOMS 
IVC.RCS). Entry. Aero. landing 

• Crew initiates guidance and control modes and monitors — 
control automatic throug.n G.NSC computer 

Control 

stick 

steering 

• Orbital ;C.MS TVC or RCS), Entry, Aero. 
Landing 

• Manual control and guidance Displays through GNiC 
computer 

• Rate command, attitude hold, and RCS minimum impulse; 
RCS translation— acceleration command 

Manual . 

• Aerodynamic 

• Manual control through ASAS 
Rate command and daino 

Vr.-Ml 

* V : • * " l' ' ’ ■ T r ;r - ’ r * ? ■ j 2 J ‘ ‘ ‘ * 

• -*■■> .3 c Sre ar.-j d.3^.2 

• 
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1 Crew steering information is provided on a cockpit CRT. Display 

8 information is processed through a Modular Display Electronics (MDE) 

9 unit. The backup entry and aporoach/landing control uses a simple SAS rather 
than direct control to improve handling qualities. The scheme is 

shown below: 


TRIM 



P~ i.i ) 


TRIM 



Figure 2-94. Entry Back Up Flight Control System 




Figure 2-98. Approach/ Landing Back Up Manual 
Flight Control System 


< 
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7 The full GN&C system is illustrated below: 




10 , Control System, Line Replaceable Units (LRU's), are as follows (not 

including GNfiC computers or their interface elctronics): 

TVC Monitor 
MRS TVC Drivers 
0MS/TVC Driver Unit 
APS Dfiver/Moni tor 
Throttle/Speed Brake Electronics 
Manual TVC/RCS Control 
Aero-Control Electronics Unit 
Aero-Backup Electronics 
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Interfaces with other systems are illustrated below: 
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Provision is made throughout the system for failure recovery. 
Redundancy management and failure provision are summarized in the 
tables below: 


Table J-24. Phased Buildup and Redundancy Management Influence GN&C Packaging 


Function 

Unit Packaging 

Rationale 

Jet select 
logic and 
drivers 

• Logic in GN&C computer 

• Drivers in 3 units, dual power supplies 

• Allows flexibility for redundancy management for dual 
failure 

• Provides spatial diversity, minimizes number of drivers to 
provide FO-FS 

83ckup 

GN&C 

• Dedicated gyro, accelerometer units 

• Dedicated aero-control electronics 
units 

• Dedicated P.CS, TVC unit 

• Separate computation in f/DE 
processor 

• Allows backup GN&C to be functionally independent 

• Delays RCS/TVC implementation to first vertical flight. FHF 
qual integrity retained by avoiding rework for fVF 

• Delays implementation to FVF 

• Protection against primary system single point software 
failures 

7VC gimbal 
drivers 

• Three units, dual supplies. Each drives 
one redundant actuator in each 
engine, primary or backup control 

• No gimbal loss after two failures. Delays implementation 
to FVF 

Aero-control 

electronics 

• Three units. Each dedicated to one 
level of redundant actuators on each 
surface, primary, or backup control 

• Fail operational after one failure. Detection capability 
remains for transfer to backup. Delays driver avionics cost. 


FVF— first vertical flight; MCE — modular display electronics; f HF — first horizontal flight 



-•i - I I i i i I. i J . I i L 

Table 3-26. GN&C Redundancy Management Considerations 


Consideration 

Trade Studies 

Implementation and 
Solution 

GN&C redundancy level 

Redundancy level versus pro- 
gram costs, (aborts, hardware, 
operations, weight, power, 
and cooling) 

FO-FS best. Triplex primary 
system with unlike backup 
path 

Hardover 3erosurface/ TVC 
failures cause vehicle loss 
(allowable detect and cor- 
rect trrv.es 0.5 sec. much 
less than pi ot reaction 
capability) 

Position sum actuators, eperate- 
standby actuators, and force 
sum actuators 

Use force sum actuators with 
simple pressure monitors to 
switch per conventional 
aircraft practice to “fail soft” 

Protection against single- 
point GN&C software failure 

Cost of exhaustive software C/0 
against cost of unlike sepa- 
rate -Jth string 

Use unlike "get home safe” 
GN&C 4th string 

False failure detections caused 
by siring cc emend diver- 
gence from control law- 
integrations and guidance 
sensitivities 

Cross-strapping I ’.'U s and 
computers or cross-strapping 
IM'J's only 

Cross-strap IMU: allows simple 
mechanization 
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Tabic 3-2 7. GX&C Failure Recovery Sequences 


First failure 

Second failure 

Element 

Detection 

and 

Correction 

Sequence 

Element 

■ | ■ 

GNSC 

Status 

IMU 

H 

IMU 

E 

Safe 


B 

Operational 


c 


Backup cherinei 

D 

Safe 

Navigation ‘aids 

B 

IMU 

A 

Operational 


f 

Safe 

Drive's, servos, -er.so's ; G 

Safe 


Safe 

Primary drive*;, 
servos, and 
ssr-sors 

c 

hVU A 

Operational 

Navigation aids, computer i F 

Safe 

Drivers. $?'vc5. ss^sers i G 

- 

$are 

Sac«ap cnannei j D 

Safe 

3ackw 

D 

IMU ! A 

Safe 

Navigation aics. cent surer i 3 

Safe 

Dr. serves, centers C 

Safe 


Defection and torreeticn seouancs 

A. uo'ect'cn-. So;t»v-ire compare in ON AC computers 
Corrsctiin Software micvafae select in C-NSC computers 

B. Detection? Hardware cor, oars :n com.rr.jr.a monitor and in pressure-driver monitor 
Correction Manually disengage faded cnannel. or pressure-driver monitors automatically dis- 
engage failed cnennet 

C. Detection: Ha.xware .compare rn pressure -driver monitors 

Correction fjii-soit by fores fight-auicmatically disengage failed channel 

D. Detection: Servo monitor -aero'. CRT beckua goi&ocet. ?iTE . 

Correction: None recurred tor space since rtor-ra;!, ^engaged: auto disengage for aero 

E. Detection: So'tv.are co-roare in CNSC computers 

Correction Manual switen to fcaenup automatic ^software freeze on last inertial data point on 
discomoarei: if isolated bv SHE. option to revert to primary 

F. Detection.- Hardware compare in command mentor ana in pressure-driver monitor 
Correction. Manual switchover to backup GNAC, or pressure-driver monitors automatically 

switch to backup GNAC : 

G. Detection: Hardware compare In pressure-driver monitor 

Correction- Fail-soft by force fight and automatically engage backup channel; if isolated by ; — 

BITE, option to revert to primary channel 

. T '~-! ■■ 1,1 " aN - t d '“nrent combinations of failures: the. - 




Table 3-28. Redundancy Management Key Features 


• Redundant strings interconnected only at IMU output and at the output 
force servos and jet drivers to maintain design simplicity. U.ili inter- 
connection prevents divergence in guidance computations and allows 
detection of slow degradation failures. Servo and jet driver intercon- 
nection (via monitor) required for "fail-soft.'’ 

• RCS engines divided into 3 groups electronically, each with dedicated 
GNSC computer and capable of doing all required maneuvers. 

• Hydraulic pressure monitors in the main engine TVC and aerosurface 
actuators automatically disengage a failed channel fer first failure and 
switch to backup for second. QMS 1VC is not time-critical and does not 
require a monitor. 

• When the backup system is engaged, there are no significant transients 
requiring initial corrective pitot inputs. Backup is rate command system 
that damps out failure transients automatically with rotational con- 
troller centered. 

• Steering display command monitor detects guidance loop discrepancies 
for display; no automatic action is initiated by this monitor. 

• Built-in test and self-test furnish LRU status to crew but are not used 
to automatically manage redundancy. 

• After a second failure, if the failed string can be isolated using BITE, 
control m3y be restored to the remaining good string at crew option. 
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Main engine control signals are processed through the Engine 
Interface Unit, described in 4.3.2. Main engine gimbal actuators 
are mechanized to drive to a null position if two hydraulic systems 
are lost, two hard-over servo valve failures occur, or if two electrical 
'signals ™are 'Tost. 'Hydraulic pressure monitors in the main engine TVC 
actuators automatically disengage a failed channel upon the first 
failure and switch to backup upon the second. Main engine control 
interface is illustrated below (one per engine): 


OR8ITE R | MAIN ENGINE 


V-'vM’Al 

CO NT ROLS 


I S SAND 
transmitted 


INTER? ACE I 

UNIT 


PCM 

I RECORDER 


SIGNAL I 
PROCESSOR I 


ENGINE 

CONTROLLER 1 



, irri 

COMMAND 


GNAC 
CCV-PUT 1 R 

|JJ 


J3MS basic gimbal design technique is the same as that employed on the 
Apollo CSM. It employs electro-mechanical actuators incorporating 
redundant drive mechanisms. RCS thrusters will be activated by a fuel 
operated valve, controlled by an electrically operated valve. RCS 
engines are electronically divided into three groups, each with dedicated 
GN&C computer and capable of doing all required maneuvers. 
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The aero-surface control system receives its input from the three- 
channel primary control servo and a single-channel backup servo. 

These inputs are summed mechanically and coupled by linkage to the power 
actuator. Load 1 imiting/override bungees are provided to prevent 
excessive loads in this linkage system for both power-on and the power- 
off droop condition. "Two dual tandem irreversible surface actuators 
are connected to each of the pinned together elevons. The rudder panels 
serve dual functions being used for aero-control and speed brakes. Two • 
dual tandem actuators are connected to each side of the rudder panel to 
provide this control. Hydraulic power for actuation is provided by 
the four independent vehicle systems to individual sections of the dual 
tandem actuator. Aero-surface hinge moment and rate requirements for 
reentry and landing are provided with any two hydraulic power sources 
operating. 

Hydraulic pressure monitors in the aerosurface actuators automatically 
disengage a failed channel upon the first failure, and switch to backup 
upon the second. The aero-surface control mechanisms are illustrated 
be! ow: 
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17 Elevon deflection ranges from -40° to +15° (negative is trailing 

edge up). Rudder deflection is +15°, while speed brake deflection 
ranges up to 70°. Sensor LRU's, excepting those covered in section 
4.10., are: 

„IMU Xincl.uding .power ..supply) 

Star Sensor 

Horizon Sensor Assembly 
Rate Sensor Package 
Accelerometer Package 
Air Data Package 
Angle of Attack Transducer 
Gyro/Accel Package 
Backup Optical Unit 

18,7 Three Inertial Measurement Units (IMU's) will be carried. The IMU's 

will be all-attitude, forced air cooled, gimballed devices, each weighing 
47 lbs., and requiring 120 watts of power. I MU outputs are cross-strapped, 
19 feeding each IMU output to each computer. Each IMU will output inertial 

7 acceleration and attitude. IMU error sources are tabulated below: 


i ; 

Char?c , ,?"f 4 - , c 

Eouspfnsnt 

C?r 

Crrcr 


E'.iS 

2b 

100 

.. 

Scale factor (%) _ 

0.0025 

0.0150 


Incut/Output axis misalign (sec! 

10 

40 

GJw*-- 

Scale factor (%) 

0.04 

0.10 


Ginsens drift (*/hr) 

0.03 

0.05 


Mass unbalance input axis (7 hr/g) 

0.1 

0.1 


Mass unbalance spin axis P/hr/g) 

0.03 

0.10 


Anisoelastic (’/ hr/g r ! 

O.C03 

0.100 

Gimbal 

r.e *>ojt (two-srecd- (sec:- 

25 

72 


1,7.20 IMU's will be eapable of fine alignment using star trackers and/or horizon 
18 sensors, and coarse alignment using the backup optical unit. Fine 

7 alignment accuracy will be within 1 arc-minute. Three star trackers 

18 will be carried. Star trackers will use image-dissector type detectors 

hard mounted to the spacecraft structure.. They will be capable of obser- 
vations within a fixed field of view; about 17° by 17°. Line-of-sight 
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motion within the field of view will be electronically tracked. 

Capability to track sunlit or beacon lit rendezvous targets will be 
included to provide rendezvous bearing. Star tracker on-axis random . 

7 error and bias will be within 30 arc-seconds (la). Three horizon sensors 

will be carried. Angular error (limited by horizon definition) will be 
within 6 arc-minutes (la). A Crewman Optical A1 ignment Sight (C0AS) 

1,18,21 will be included. It is a manual sighting device mounted in the left 
window, oriented along the spacecraft +x axis. It will be capable of 
repeated removal, stowage, and remount without elaborate calibration. 
Sufficient accuracy will be provided to allow backup rendezvous tracking, 
IMU coarse alignment, and backup system alignment. The device will be 
similar to the Apollo and Gemini instruments. Instrument, alignment, 

7 and limit cycle error is expected to be within 11 arc-minutes (la). 

7,18 Three body-mounted rate gyros will be employed in each of the three 

i GN&C -Strings. Rate sensors will be conventional spring-restrained, single 

degree of freedom rate gyros. , Individual rate gyro operational and 
status monitor signals will be transmitted for each gyro. These gyros 

will provide body rate data for normal control purposes, and will be 

; ; ! j ; : j ! ' ! : : j i | ; I : i ■ I i . i ‘ 1 ! •' 

located in the best location (s) to aid in suppressing body-bending 

deflections and load alleviation. Two body mounted accelerometers, 
mounted one each in the yaw and pitch axes, will be employed in each 
of the three GN&C Strings. These instruments will be of a spring-loaded, 
seismic mass type. Air data is provided by vehicle nose pressure 
1 ports at high altitude and by redundant probes deployed at lower altitudes. 
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A DC-10 type digital air data computer will be aboard. A strapdown 
7 gyro/accelerometer package will be provided for the backup GN&C 

system. Backup sensor accuracies are tabulated below: 
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• 

RATIONALE FOR ASSUMPTIONS 



not applicable 
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4.10 Communications and Tracking 


There are three general systems to be used in conjunction with the 
Shuttle Mission. These are the Spacecraft Data and Tracking Network 
(STDN), the Space Ground Link System (SGLS), and the FAA Air Traffic 
Control Network (ATC). 


Primarily the communication system uses existing equipment. The equip- 
ment of the STDN network is compatible to the equipment installed in 
the SGLS network. The SGLS network will provide secure voice and data 
networks for classified missions. The ATC equipment gives the shuttle 
landing capability at almost any large airport. 


The Shuttle orbiter vehicle contains transponders for tracking and 
navigation, telemetry television command, and voice. Tracking, tele- 
metry command and voice link (TTCV), television transmission, and pay- 
load data/voice channels are compatible to the Spacecraft Tracking Data 
Network in current operation. S-band equipment is provided for the 
Satellite Control Facility (SCF) TTCV by the Space-Ground Link System 
(SGLS). ^In addition, S-band equipment is provided for voice and data 
crypts and normal payload data and voice relay to ground. Navigation, 
tracking/landing aids, and communication equipment is provided for 
flight which is compatible to the Air Traffic Control (ATC) system 
currently in operation. 


The communications system also controls antenna selection, audio and 
video processing equipment, and signal distribution controls. The sub- 
system flow diagram, showing general functional requirements and functiona 
redundancy is shown in Figure 4.10.2-1. 


5io*. s>*ct 


4-153 
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FIGURE 4.10.2-1 


COMMUNICATION AND TRACKING SIGNAL FLOW 
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The only major change required for any currently operational communication 
system is to the glide slope transmitter located at the primary and 
alternate landing sites following a space operations. 


The orbiter vehicle is equipped with antenna systems oriented for communi- 
cation coverage at specific vehicle attitudes. Selectable antennas are 
.used for 'i-ncreased -geomefrfc pattern -coverage 'Where required. Figure 
4.10.2-2 shows the relative location of the antennas and the type (polar- 
ization) of the patterns. Attenuation of the radiated patterns is modified 
by body geometry as shown for each frequency band. Selection of the 
strongest signal/antenna is accomplished by automatic switching logic. 


10.1. S-Band 

The Shuttle vehicle uses three S-band frequencies for communication. 
There are two transmission frequencies (air to ground) of 2272.5 (+2.5) 
mHz and 2287.5 (+2.5) mHz. The receiving frequency is 2106.4 (+2) mHz. 

The on-board receivers have a nominal receiver sensitivity of 97 db. 
On-board transmission line losses are estimated at -10 db from the 
receiver/tra&smitter to the antenna. The on-board transmitters have a 
TBD watt power capability. With this power the air-to-ground link has 
complete coverage with no signal attenuation where line-of-sight between 
the ground station and shuttle exists. 

S-Band OMNI Antennas 

There are four right hand circularly polarized, flush mounted helix 
antennas, located at intervals about the ci rcumference. of the orbiter. 
The omni antennas provide near-earth communications. The antennas 
are utilized individually and are selected by S-Band Antenna 
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switches. Figure 4.10.2.1-1 is a typical antenna pattern for any one 
of the 4 OMNI antennas. 

MSFN Unified S-Band Stations 

Table 4.10.2.1-1 gives the Call Letters, Names, and Lat.-Long. locations 
of the S-Band ground stations. Goldstone, Madrid, and Canberra stations 
are equipped with 85 foot "Dish" antennas with 51 db gain. The remaining 
stations have 30 foot antennas, with 43 db gain. Power output of all the 
stations is variable from 1 to 10KW. 

4.10.1.1 S-Band Voice 

Duplex (simultaneous two-way) voice operated relay (VOX) voice communica- 
tion is provided for crew members headsets. Normal voice duplex communi- 
cation is provided by transmission of a phase modulated 2287.5 me carrier 
-1250 kc subcarrier, and reception of a phase modulated 2106.4 me carrier 
-30 KC subcarrier. Backup voice communication for down voice is provided 
■| by transmission of a direct phase modulated 2287.5 me carrier. Backup 

i 

i voice communication for up voice is provided by using the up-data 70 kc 

subcarrier of the 2106.4 me carrier. 

4.10.1.2 S-Band T/M 

Digital telemetry data will be by pulse code modulation (PCM). The high 
data bit rate of < 256 Kbs is provided by direct phase modulation of the 
2287.5 me carrier. The low data rate of 128 Kbs is provided by trans- 
mission of a 2287.5 me carrier-phase modulated by a 1024 kc subcarrier. 

Analog data transmission is provided by a 2272.5 me carrier using sub- 
carrier frequencies of 65, 76, and 95 Khz. All data for these subcarriers 
undergoes crypto secure processing prior to multiplexing. 


u. 
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On-board data recorders are provided for PCM data for later transmission 
to a ground receiving station. 

4.10.1.3 Command Data 

The Shuttle has provisions for accepting digital encoded commands. The 
up-data link for this use has a maximum data rate of 2 Kbs using the 
2106.4 me carrier, phase modulated by a 70 kc subcarrier. 

4.10.1.4 Video 

Television transmission is provided by an analog video signal directly 
frequency modulating a 2272.5 me carrier. 


4.10.1.5 Wide Band Data Link 

A wide band transmission link is provided for payload or main engine data 
(as applicable) in lieu of the video channel. Note: Lower response pay- 

load data will be transmitted as a part of the standard T/M data. 

! « 

j4 . 1 0 . 1 .6 Range Measurement . j 

| The S-band equipment provides the capability for Doppler tracking and j 

I 

1 pseudo random noise (PRN) ranging by receiving and transmitting in phase 

\ coherence on the 2106.4 me carrier. „ r - 
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Ship 1 
MIL-71 
BDA-02 
CYI-OU 

.ach-75 

CR0-08 

GWM-2U 

HAW-12 

MAD-23 

HSK-25 

GDS-28 

PKS-96 

TEX-16 

MAR-95 

STN-0'0 


Insertion ship S-band 
Merritt Island S-band 
Bermuda S-band 
Grand Canary S-band 
.Ascension .S-band 
Carnarvon S-band 
Guam S-band 
Hawaii S-band 
Madrid deep space 
Canberra deep space 
Goldstone deep space (85 ft) 
Parkes deep space 
Texas S-band 

Goldstone deep space (210 ft) 
Stanford, California, S-band 


4-lbO 


10/20/72 


n "• 

TABLE 4.10.2.1-1 


STDN station characteristics 


Geodetic latitude, LATR, deg 
Longitude, LONR, deg 
Altitude, ALTR, ft 
Range capability, SRANGE, n. ml. 

Keyhole, FTINDC: 0 » none 

1 ■ north-south 

2 • east-wast 


RADAR aD«*23 X-Y USb-65b LATR ■ <40 **45999 1 , LOnR ° 3&5, 83015 ? 

ALTR o 2503o 276# SRANGE ■ flSOOQQ.O. FTInDc « 2oO 

RADAR bHSK~2£ X-Y USb-0*. LATR b « 35 e 58 3 R 9*4 , LOnR « 190,976921 

AlTR b 3799,993, SRANGE a 850000*0# FTINDC a 2*0 

RADAR oGDS-2a X®Y USb- 05* LATR a 35*3*4 159*4 , LOnR s 293,125015 
ALTR » 3021,698, SRANGE as aSGOuGeO, FTINDC b 2*0 
RADAR ®PK.S«96 H-Q USB2lo, LATR «* =32*998769, LOnR « 1*40.263517 
ALTR o 1322.176. SRAnGE a2lOQOOO.O. FTINDC a 0*0 
RADAR ofUR-95 H-0 USs2lA, lATR * 35**425958, LOnR * 2*43.110517 

ALTR a 3169.286* SRAnGE «21QOOlU.O, FTINDC b 0*0 
RADAR ®STN»O0 A-E USalSfl, LATR a 37**409722, LOnR » 237,822003 
ALTR <* 525.0(10* SRANGE «l50QOu0»0. FTINDC « 0*0 

.RADAR sMiL-71 X-Y USg«3«* lATR » 28.5Q8272, LOnR * 27?.3oSl*42 

ALTR 0 <.177* 165, SRANGE a 3 OOO 0 U.O, FTINDC « 1*0 
RADAR 8BDA»02 X-Y USa-3r>, lATR » 32*351250, LOnR « 295,3*4001*4 

ALTR o =191,075. SRAnGE. a 3000UO*0, FTINDC » 1*0 
RADAR aCYl-00 X-Y U 5a -3n , LAT R b 27*76*4536, LOnR ® 3*4*4, 3*469*45 
ALTR * 5B7.269, SRAnGE a aOQOuu.Oi FTINDC b 1*0 

RADAR bacN-75 X»Y u5b-3A, lATR « -7*959799, LONR » 395,67155*4 

ALTR »■ 1720.999 , SRANGE «* 30CQu0*0i FTINDC «*. 1*0 

RADAR *CR0»O8 X-Y US8®3c, lATR ** -2*4 *906577, LOnR a 113,72*4102 

ALTR b 1 6 . *4 f> *4 1 SRAnGE «» 300000*0, FTINDC » 1*0 

RADAR » G « M = 2 9 X»Y uS&«3n* lATR » 13*310875, LONR 0 19*4,735*427 

ALTR * 379.015, SR AN G t ■ 300000«0* FTINDC » 1*0 

RADAR * H-A ft — 1 2 X-Y uSB-3n, lATR 0 22* 126307, LOnR 0 2O0.3339SQ 

ALTR » 3799*993* SRANGE ® 300Uo0»O» FTINDC » 1*0 

RADAR bTeX -16 X-Y USB-3n» LATH « 27*653750, LOnR ° 262.619990 

ALTR s <,1 27,952 , SRANGE « 3000uo,0* FTINDC » 1*0 

RADAR *SwiP 1 INSERTjON , tATR 27*0000o0, LOnR “ 3ll.00Lu00 

ALTR <* 0*000* SRANGE * 239uU«0, FTINOC » 0*0 
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4.10.1.7 Rationale 
The system described in Reference 166 uses basically the same system 
as the Apollo Command Module Communication and Instrumentation System. 

4.10.1.8 Reference 

166 Pages 3-109 to 3-113 

1. Communication and Data System - Spec 
North American Aviation MC901 -071 2 
29 Jan. 1968 

2. CMS-SU-21 -Section A Apollo Master 
Command Module Simulator, Communication 
and Instrumentation System Specifications 
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10.2 VHF System 

166 The Shuttle Orbiter has two VHF amplitude modulated carriers of 296.8 me 

1 and 259.7 me. Transmission or reception on either frequency is provided 

2 by using two receivers and two transmitters. Four antennas are provided 
for selection by automatic switching logic. Vertical polarized antennas 
are provided at the orbiter tail cap and belly. Right Hand Circular 
Polarized (RHCP) RF patterns are provided on each side of the fuselage 
by helix cavity antennas. 

166 The system provides a duplex loop suitable for simultaneous voice commun- 
ication and also provides a low rate data transmission and command link 
of 2 Kbs for detached payload communication. 

166 The orbiter vehicle has two VHF transceivers that are frequency modulated. 

1 The channel frequency is selectable for use of voice communication with 

2 Air Traffic Controllers during approach and landings. This system shares 
the same antennas as the duplex system. A triplexer functions to allow 
simultaneous operation of three transmitters or receivers off of a common 
antenna. RFIJosses by the triplexer are less than 1.5 db. 

j 

166 Each of the STDN stations has a VHF system usin-g directable narrow-beam 

1 antennas fed from the main dish. This system gives air-to-ground commun- 

2 i cation at orbital altitudes under any vehicle attitude when line-of- 
sight conditions exist. 

166 The ATC system uses the VHF band for control of air traffic during the 
orbiter re-entry. The orb iter- ground link for ATC is established 
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following re-entry. Prior to this time, the vehicle will not be in 
1 ine-of-sight, is blacked out from re-entry heat, or is out of range/ 
reception because of distance. 

4.10.2.1 Rationale 

The system described in Ref. 166 uses basically the same system as the 
Apollo Command Module Communication and Instrumentation System. 

4.10.2.2 Reference 

! 166 Pages 3-109 to 3-113 

1. Communication and Data System - Spec. 

North American Aviation MC901-0712 
dated 29 Oan. 1968 

2. CMS-SU-21 Section A, Apollo Master 
Command Module Simulator, Communications 

,• and Instrumentation System Specifications 

( 4 . 1 0 . 3 UHF System 

' 166 A UHF transponder gives the orbiter voice communication capability with 
the Ground Controlled Approach (GCA) of the airport for low visibility 
j landings. The transponder has selectable channels that are preset prior 

to takeoff. This system has a maximum operational range of 50 miles. 

The orbiter antenna system is located in the three-wheel wells. The 
ground-based system uses an omni-directional antenna such as a corner 
reflector di scone or top-hat antenna. 

4.10.3.1 Rationale 

The system described in Ref. 166 uses basically the same system as the 
. Apollo Command Module Communication and Instrumentation System. 

4.10.3.2 Reference 

166 Pages 3-109 to 3-113 
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4.10.4 Audio Control Center 

166 Each crew station has audio control equipment to accomplish audio 
1 signal amplification and switching to select intercommunication between 
the crew station, to select communication RF links, to select recording 
equipment, to relay audio signals received. Each station has provisions 
for connecting a second headset for emergency operations. Automatic 
volume control is provided to balance the output for strong/weak signals. 
Standard Push-to-Talk (PTT) and voice-operated relay (VOX) mike circuits 
will actuate the transmitters to a "Transmit" condition. 

166 Two communication panels provide redundant controls over the power 
1 system-communication system interface. Access to the channel selector 
controls is provided between the pilot-copilot positions. Access to 
the crypto secure terminals is provided at the crew station aft positions. 

4.10.4.1 Rationale 

The system described in Ref. 166 uses basically the same system as the 

i 

- Apollo Command Module Communication and Instrumentation System. 

4.10.4.2 Reference 

166 Paqes 3-109 to 3-113 
j 1. Communication and Data System - Spec. 

North American Aviation - MC901-0712 


dated 29 Jan. 1968 
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4.10. 5 TACAN 

ll6 TACAN is a phase measuring high speed rotating ground based beacon providing 

4 highly accurate azimuth determination in combination with a ground based 

21 transponder providing distance measuring. TACAN covers the frequency range 
1 of 962 megahertz to 1213 megahertz* with 1 megahertz channel spacing. Bearing 
.information (aircraft to s.tation) is accomplished by a phase comparison of 
two equal frequencies. One frequency is fixed in phase aligned to true north 
while the other is rotated. The phase difference at the aircraft position 
establishes the relative bearing to the station. The Distance Measuring 
Equipment (DME) has two modes of operation. The airborne interrogator pulses 
at a relatively high frequency in search mode. Once lock-on is achieved with 
the ground based transponder, the pulse repetition frequency is reduced. 
Identification messages are transmitted each 30 seconds in morse. The ability 
to communicate between the aircraft and the ground station is a function of 
line-of-sight range and altitude. Accuracy of bearing information is within 
+. 1*5°. Accuracy of the DME is +_ 0.2 percent of the distance measured. A 
"cone of confusion" exists directly over the station for bearing information 
but does not exist for the DME. The system will provide range and bearing 
information to the Guidance, Navigation, and Control subsystem and to the 
Display and Control subsystem. The TACAN will operate in the L-Band of the 
radio frequency spectrum. A self test feature will provide a visual indica- 
tion of "GO /NO-GO" status of the functional units. An aural identification 
signal will be provided to the intercom- equipment. Controls will be provided 
to allow the crew to select the desired channel. All modes will be simulated 
including multiple location of ground stations and search prior to lock-on. 
Radiation patterns of the ground station will be simulated including the 

i 

radio horizon, maximum range, and cone of confusion. Accuracy bounds will 
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approximate those of the real-world equipment with resolution and update 
rates which will cause no noticeable discontinuities in either the dis- 
plays or the on-board computer. 

For in-orbit use , the TACAN system will be employed as a range and range- 
rate system. This will be accomplished by installing a TACAN ground 
transponder in the vehicle to be tracked or to which rendezvous is being 
made. This usage of TACAN will be very similar to its current use in 
air-to-air refueling operations. 

If. 10. 5.1 References 

4 pp. 9-12c-8 

21 pp. 56-57 

l) Radio Navigation Systems for Aviation etc., Bauss ( 1963 ). 

Reference Data for Radio Engineers, Federal Telephone (1953). 

1 66 pp. 3-109 to 3-113 
k.10.6 Radar Altimeter 

! 

1 l66 The radar altimeter system measures altitude relative to the local ground. 

i 

The system operates in the C-Band of the radio frequency spectrum and is 
used in th^range 0 to (TBD) feet. Outputs of the system are to the 

■ 1 

| Guidance, Navigation, and Control computer and to the Control and Display 

Subsystem. A model of the ground terrain is required with highly 

accurate models of the prime landing sites nominal approaches. Off-nominal 
and secondary landing sites will be approximations requiring lower accuracy. 
U. 10. 6.1 Rationale 

Not required. 
k.10.6. 2 References 
i 1 66 Pages 3-109 to 3-113 
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4.10.7 ATC Transponder .. . 

The Air Traffic Control (ATC) transponder will be used to identify and 
track the orbiter during post-entry phases of the mission. The ground 
control station will transmit interrogation signals to the transponder 
in the orbiter which will respond in the L-Band with altitude and iden- 
fi'fi cation signals to the -ground 'station. The -transponder will be compatible 
with continental United States and international operations requirements. 

The L-Band antenna switch will control interface of the ATC transponder 
and TACAN with one of the two antennas. Signal attenuation presents a 
non-linear altitude versus range limitation in the L-Band. The ATC trans- 
ponder altitude limitation should be programmed as a variable similar to 
the TACAN coverage. The radio horizon can be represented as: 





r > r shuttle -> not visible 

The index of refraction in the lower atmosphere (to about 10 miles) decreases 
with height. Radio frequencies above 200 mhz. follow curved paths slightly 
bent toward the earth. By replacing the real earth radius with one of 4/3 
the true radius (5284 miles) the coverage can be considered straight lines. 
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A good approximation for the distance to the radio horizon 
h -> altitude in feet 
d -> radio horizon distance in miles 

is d = y' 2h 


Over a smooth earth, line of sight is maintained if the distance in miles 
between antennas is less than <rsr. 

^.10.7.1 Rationale 

Not required. 

U.IO. 7.2 References 

166 Pages 3-109 to 3-113 



< 

CO 
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it. 10. 8 
it • 

21 

166 


Instrument Landing System (ILS) 

The ILS system is a fixed directional beacon with a directional (localizer) 
and elevation (glideslope) beam about a reference path in the plane of the 
runway centerline. The DME is used in conjunction with ILS to provide range 
to go information. The localizer coverage is approximately +_ 35° at 25 N.M. 
gfburi'd"range an'd "+.'360° -for TO -N-.-M. ground range. The .glideslope coverage 
is +_ 10°. Elevation coverage is approximately 20° for both localizer and 
glideslope. The coverage range is 25 N.M. slant range for the localizer 
and 10 N.M. slant range for the glideslope. The beam is considered linear 
in a 4° range for the localizer and +^0.8° range for the glideslope with 
respect to the reference path. The display is a "fly-to" error presentation 
The localizer has a single null while the glideslope contains multiple nulls. 

. The simulation will provide two glide slopes with each independently adjust- 
able. The steep slope will be typically 13° centered with ground intercept 
at 5000 ft. from the end of the runway and the shallow will be typically 3° 
i centered with the ground intercept at 1000 ft. from the end of the runway. 

Both the localizer and glide slope will be independently adjustable and 
located at the landing site. False nulls in the glide slope will be simulate}! 

j 

The ILS system will be used for horizontal flight test only. 

4.10.8.1 References: 

4 pp. 9.12c-5 thru 9 
21 pp. 3-244 
166 Pages 3-109 to 3-113 





DATE 10/20/72 

THE SINGER COMPANY 
SIMULATION PRODUCTS D 1 V l-S 1 ON 

PAGE NO. 2 i-170 

REV. 

B INGHAMTON , NEW YORK 

REP. NO. 


it. 10. 9 GCA Radar 

. 166 Each major airport in the continental U.S. is equipped with a Ground 

Control Approach (GCA) radar system. This radar is a skin-track pulse 

! system which provides cross track, distance from touchdown, and height 

j 

above glidepath to the GCA operator. The operator, using the UHF com- 
.munication system, .can -direct *air.c raft -down through overcast conditions 
to a Category II landing. GCA radar will control the final approach 
from H to T N miles to touchdown, 
j i+ . 10 .9.1 Rationale 

All commercial and military aircraft use GCA for Cat. II landing in 
j overcast conditions. 

: i».10.9.2 References 

Instrument Flying Handbook, AC 61-27A, 

Dept, of Transportation, Federal Aviation 
• Administration 


166 Pages 3-109 to 3-113 
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4.10.10 Air Route Surveillance Radar 


l66 The FAA within continental U.S. has a series of overlapping radar systems 
that provides a map- like presentation of all aircraft within a defined 
zone. The radar system is composed of many skin-tracking radar installa- 
tions or sectors. Each installation has a maximum range of 200 miles or 
less dependent on aircraft altitude (line of sight). These many installa- 
tions are united into one control center for all traffic control. By means 
of electronically generated range marks and azimuth indicators, the con- 
troller can locate each radar target with respect to the radar installation, 
or can locate one radar target with respect to another. From direct reading 
counters on the controller's display panel, the controller determines the 
hearing and range of one aircraft target with respect to another. A video 
presentation not only gives him aircraft position, hut their ' relation to 
other runways, navigation aids, and hazardous ground points in the area. 

4.10.10.1 Rationale 

FAA will control all air traffic into commercial or military air terminals. 

4.10.10.2 References 

Instrument Flying Handbook, AC 6l-27A, 

Dept, of Transportation, Federal Aviation Administration ; 

l66 Pages 3-109 to 3-113. 





- 398 - 8 - 


DATE 10/20/72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE NO. 4-172 

REV. 

L 

BINGHAMTON. NEW YORK 

REP. NO. 


4.10.11 Precision Ranging System (PRS) 

158 The PRS system may he used by the shuttle from post-blankout at an 

166 altitude of approximately 140,000 ft. to touchdown. The system consists 

of a shuttle based interrogator and multiple transponder beacons located 
at ground stations. As many as 10 PRS beacons could be interrogated by 
the shuttle during the approach ’and -landing sequence. 

158 This navigation system is based on using an inertial measurement unit 

166 (IMU) and a precision ranging system (PRS) as the primary sensors. The 

IMU measures changes in vehicle velocity due to non- gravitational forces 
on the vehicle. The PRS provides measurements of range and range rate 
from the vehicle to ground transponders. Range measurements are made 
twice per second using a phase comparison of frequencies. Range rate is 
measured at the same time using Doppler Shift. This system of touchdown 
has an accuracy of approximately 12 ft. altitude, 24 ft. crosstrack, 13 ft. 

1 down range, .6 ft. /sec. altitude, 1.2 ft. /sec. crosstrack, .9 ft. /sec. 

i down range. 

4.10.11.1 Rationale 

-j Not required. 

1 

4.10.11.2 References 

158 All of the Document . 

166 Pages 3-109 to 3-113 
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4.10.12 Microwave Landing System (MLS) 

157 The MLS will he used during approach and landing for range, azimuth, 
and elevation angle information with respect to the runway. The MLS 
is a sophisticated landing NavAid being developed jointly by DOD, DOT, 
and NASA and is scheduled for limited production in 1976. The system 
uses the ’Ku ‘'band.' The airborne 'antennas will .provide azimuth coverage 
of + 45 degrees, and elevation coverage of + 30 degrees referenced to 
to the Orbiter longitudinal axis. Pour transmitter antennae will be 
used in the MLS. The range, azimuth, and long range elevation will 
operate in the C band while the flare elevation antenna will operate 
in the Ku band. The C band transmits data in a 20 N.M. range by 60° 
azimuth by 20° elevation angle. The Ku band flare antenna transmits 
-elevation data in a 2 N.M. range by 8° azimuth by 8° elevation. 

Accuracy of the system is estimated at 1 ft. altitude, 7 ft. in cross- 

! track, .5 ft. /sec. altitude rate, and .6 ft. /sec. in crosstrack. These 

! . i 

: estimates are based on using a measurement update every 4 seconds. ; 

4.10.12.1 References 

j 157 Kriegsman, B. 

"Entry and Terminal- Phase Navigation for SSV Orbiter Using MLS or 
AILS and V0R/DME," MIT Draper Lab 23A STS Memo No. 11-72, Feb. l6, 1972. 

158 Kriegsman ,’ B. and Gustafson, D. 

"Entry-and- Landing Navigation Study for SSV Orbiter Using a PRS Navaid," 
MIT Draper Lab 23A STS Memo No. 49-71 (Ref. l), Oct. 4, 1971. 

Gustafson, D. and Kriegsman, B. 

"SSV Re-entry Navigation Studies Using Barometric Altitude and V0R/DME 
Measurements," MIT Draper Lab 23A STS Memo No. 22-70, July l4, 1970. 

4.10.12.2 Rationale 
Rot required. 
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166 


4.11 Operational Instrumentation 

The orbiter vehicle is equipped with two types of instrumentation dependent 
on the mission objectives. Development Flight Instrumentation (DFI) will 
provide the required data for in-flight and post-flight evaluation for the 
initial flights. Once the developmental flights have been completed, the 
4nstrumen.tati.on sys.tem will be converted to the Operational Flight Instru- 
mentation (OFI). 


166 


The data collected from sensors is conditioned for display and monitoring on- 
board the vehicle, provided to computers for CRT display, recorded, telemeter 
to the ground, and also provided to group support before and after launch. 


ed 




< 


Table 4.11-1 shows the division of measurements per system for both OFI and 
DFI usage. Figure 4.11-1 shows the general concept of the data interface 
requirements in both flight phases. Table 4.11-2 gives the OFI and DFI 
sample rate. 

4.11.1 Recorders 

There are five categories of recorders on-board the vehicle. These are the 
maintenance recorder, a short-burst (5 min.) loop recorder, a wi de-band 
data recorder, a crash (FAA) recorder, and a voice playback unit. The 
recorder functions are straightforward with the following special features. 
The playback of the maintenance recorder is not required for flight crew 
training. This recorder is played back following a mission landing. The 
loop recorder is a cued recorder which is controlled manually or auto- 
matically by GN&C or C&W systems. This recorder will be used by the crew 
in problem analysis during flight. There is no requirement for the wide- 
band recorder. The crash recorder is not required for simulation. This 
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166 is outside of crew training requi rements. The voice recorder is required 

The system should provide near real world simulation interfacing with all 
active voice or T/M (simulated) lines. 

4.11.2 Sensors and Signal Conditioning 

166 The types of signal sensors are indicated in Table 4.11-1 Table 4.11-2 

N 

indicates the sample rate for PCM inputs. The data rate (maximum) is 256 
kbs and is programmable in 4 formats. Inputs to the signal conditioning 
units is 0-5 volt and 0-20 millivolt full scale. Dedicated spacecraft 
instruments use dual 0-5 volt inputs. Total error for instrumentation is 
distributed as follows: 


Sensors 

3.0% 

Signal Conditioners 

1.0% 

Noise 

0.6% 

PCM 

0.4% 


4.11.3 Ground Support Equipment PCM Links 

66 There is no requirement for simulation of preflight GSE activity occurring 

prior to the crew boarding the vehicle. GSE maintenance/monitoring must 
be complete prior to that time. By the same ground rule, there is no 
requirement for preventive maintenance simulation for main engine performance 
evaluation. 


66 

A 


4.11.4 Caution and Warning System 

Instrumentation sensors are provided for 200 major critical flight parameters. 
Parallel systems are provided to display the problem to the crew and to 
provide input data to the GNC computer where required. 
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A 


A 

B 


Redundant caution and warning indicator display light units are provided 
in the orbiter crew station. Klaxon ; horns, intercom speakers, and headsel] 
tone signals provide audio cues for alert. The audio tones are coded by 
frequency and pulse duration for easy recognition by the crew. 

The tone signals used from the Skylab Mission will also be used for the 
"shuttle. A siren 'STgrral wiTT indicate Tire Emergency. A 1000 cps tone 
modulated by a square wave of 1.25 cps will indicate Warning, and a con- 
tinuous 1000 cps tone will indicate Caution conditions. A rapid loss of 
pressure (Emergency) will be represented by an interrupted buzzer signal. 
Stall (Emergency) will be represented by an intermittent horn while gear 
down and locked (coupled to a low power level) will be represented by a 
continuous horn. A single pulse will represent a crew alert for incoming 
crypto message. 


Other crew alert tones will be present when crossing the Tacan Outer Markcj 
(400 Hz modulated once every two seconds), Middle Marker (1300 Hz with 
alternate dots and dashes), and the Boundary Marker (3000 Hz dots @ two 
per second). 


qr- 


Redundant sensors provide input parameters to two C/W units. Each unit is 
equipped with redundant power supplies. Caution, Warning, Emergency, and 
Crew Alerts provide inputs to set the Master Alarm units. Master Alarm is 
visually indicated on a telelight switch. Depress the switch with an alarm 
on will silence the alarm. Reoccurrence of the condition will re-trigger 
the alarm circuit. 


The C/W system provides a means of disabling malfunctioning sensors through 
the use of inhibit switches. In the Inhibit position, the sensor input is 
not fed into the C/W system. 
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A. A Memory feature provides the crew with the capability to recall an alert 

signal that triggered the C/W circuit. Memory may be cleared by depressing 
the CLEAR switch. 

4.11.5 Rationale 

A. The Caution and Warning System will be similar in logic and 
^performance 'to 'the Skylab 'C&W 'System. 'Refer to Saturn Workshop Systems 
Handbook, DC-5 July 11, 1972. 

B. It is assummed that the C/W tones used for shuttle will be 
very similar to existing commercial aircraft warnings. 

4.11.6 References 

166 Pages 3-111- 3-113 







DATE 


10/20/72 


THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 


PAGE NO. 4-l80 


REV. 


166 


! 

1 


166 


I 


BINGHAMTON. NEW YORK 


REP. 


NO. 


4. 12 Environmental Control and Life Support Subsystem 

The environmental control and lift support subsystem (ECLSS) 
provides atmospheric revitalization, life support, and thermal control 
(Figure 4.12-1) with subsystem assemblies as shown in Figure 4.12-2. The 
atmospheric revitalization subsystem furnishes a shirt-sleeve environment 
for the four-man crew for a seven-day mts'STon and a 96-hour contingency 
by controlling C0 2 , humidity, odor, pressure, oxygen/nitrogen cabin atmosphere 
and cabin temperature. Six additional crewmen can be accommodated for a 
short duration. Expendable capacity is supplied for 42 man-days. The 
mission can be extended up to 30 days by adding expendables in the payload. 

The life support subsystems provide for food and waste management, fire 
control, and extravehicular/intravehicular activities. The thermal control 
subsystem affords active thermal control for avionics and mechanical 
equipment, dissipates the heat from the crew compartment, and provides 
for water management. The fluid and energy interchange functions performed 
by the ECLSS and interfacing vehicle systems are shown in Figure 4.12-3. 

4.12.1 Atmospheric Revitalization 

4.12.1.1 Pressure Control 

A two-gas atmosphere, oxygen/nitrogen at a nominal pressure 
of 14.7 psia, is used to reduce fire hazard potential and to provide 
compatibility with payload module experiments and proposed space station 
environments. The oxygen stored in a supercritical state, is acquired from 
the electrical power generation reactant storage system. The nitrogen 
is stored at 3,000 psi in two carbon filament storage tanks. Normal gas 
usage and losses as a result of venting and seal leakage are shown in 
Table 4.12-1. The subsystem includes provisions for a 10-minute emergency 
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FIGURE 4.12-3 
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Gas Loss (Pounds Per Day) 

Description 

Oxygen 

Nitrogen 

Total 

Waste management port venting 

0.21 

0.79 

1.0 

Avionics bay controlled venting 

0.42 

1.58 

2.0 

Cabin leakage 

1.26 

4.74 

6.0 

Metabolic 

. 8.0 


8.0 


Ges Required (Pounds) | 

Mission total (including reserves end cabin 
repiessurization) 

142.0 

202.0 

344.0 




TABLE' 4.12-1 


NORMAL GAS USAGE AND GAS LOSSES 
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166 


166 


166 


166 


high oxygen gas flow of 55 pounds per hour. An alarm to the Caution and Warning 
system is initiated after a time delay if the oxygen flow exceeds three 
pounds per hour. Additional quantities of oxygen and nitrogen, stored at 
3,000 psia, are connected to the primary system for one cabin repressurization 
at a flow of 150 pounds per hour, offering the four-man crew a 96-hour 
contingency, or --seven .airlock .operations. 

Gas flow into the cabin is controlled by the cabin pressure regulator, 
which sets the N 2 flow based upon the cabin 0 2 partial pressure of 3.0 to 
3.2 psia. The partial pressure control opens when the 0 2 partial pressure 
is 3.2 psia or above, permitting only nitrogen to flow into the cabin. 

Nitrogen will continue to flow until a total cabin pressure of 14.7 psia 
is reached. When, the 0 2 partial pressure drops to 3.0 psia, the partial 
pressure control closes to permit only 0 2 to flow into the cabin. 

Cabin overboard pressure relief valves are located in the cabin 
area and in the avionics bays. A differential pressure relief valve is 
provided between the cabin and each avionics bay to maintain the avionics 
bay pressure at approximately 0.4 psi below cabin pressure. A total of 
two pounds per day for three avionics bays is bled overboard to maintain bay 
pressure below cabin pressure. During times of airlock repressurization 
or emergency fire extinguishing operation in the avionics bays, the pressure 
in the bays may be as much as 0.6 psi higher than in the crew cabin. Gas 
flow into the crew cabin is prevented by check valves in the differential 
pressure regulator and the sealed avionics bay door design. 

Portable face masks and emergency oxygen assemblies are designed to 
furnish a ten-minute supply of oxygen to each crew member and passenger. 
Provisions are also available to connect these assemblies to the oxygen system 
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4.12.1.2 Cabin Humidity) CO^, Odor and Temperature Control 

A condensing heat exchanger for humidity control and cabin 
temperature, lithium hydroxide for controlling C0£ level, and activated 
charcoal for controlling air odors are used because of their proven 
performance in the CSM environmental control system. The system is 
-.comprised .of .three ^two-speed fans, two 'lithium ^hydroxide (Li OH ) canisters, 
a condensing heat exchanger, and an air bypass valve. Air volume through 
the system is governed by the cabin temperature control range of 65° to 80° 

F, selectable to ±2° F. The fans can operate at maximum flow for high 
heat load flight conditions or at reduced flow for station keeping operations, 
Figure 4.12-2 shows system performance for the four-man design condition. 

With 10 men and maximum heat load, the cabin temperature will approach 
75° F. A payload heat exchanger is included in the cargo bay with a 
capacity of 5,200 Btu/hr. Additional heat dissipation from operation of 
the mission specialists station of 1,000 Btu/hr is absorbed by the cabin 
atmosphere heat exchanger plus 2,000 Btu/hr from equipment in the avionics 
bay. The Li OH canisters are installed in two parallel flow paths. Each 
canister will be installed in the system for 24 hours, based on a seven- 
day, four-man mission. The canisters will be replaced more frequently j 
when 10 people are carried. Each canister also contains activated charcoal 
for trace contaminate control. Low toxicity outgassing materials in the 
cabin design are used to reduce contaminant problems. The condensing 
heat exchanger removes the cabin sensible and latent heat load. Water is 
removed from the heat exchanger by water separators and trasnferred to the 
waste water system for storage. A replaceable, disposable filter is 
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provided at the inlet to the fans for particulate control. 

A coldwall 


configuration has coolant flow passages attached to the cabin wall to control 
the wall temperature to prevent condensation in orbit and excessive cabin 
temperature during and after entry. All surfaces normally in contact 
with the crew will not exceed 113° F. 

4.12.2 Life Support 

4.12.2.1 Food Management 

The food management system consists of a galley area offering 
a food preparation center for food and equipment storage, hot and cold 
water dispensers, and waste storage. The GFE food concept assumed includes 
the use of protective canisters for storing food serving cans, dehydra tables, 
and drink packages. Foods are categorized as thermostabilized, rehydratables, 
wafers, and beverages. Some foods are ready to eat, and others require 
chilling or heating in the galley oven. Rehydratables are prepared by 
injecting hot or cold water and mixing. A freezer can be installed in the 
galley for extended missions by moving stored food to other areas of the 
vehicle. 

Simulation of the food management system outputs/inputs such as 
electrical loads, water usage, heat absorbtion/rejection is required. 

4.12.2.2 Waste Management 

The waste management subsystem accumulates solid waste and 
collects, transfers, and stores liquid wastes. Urine and urinal rinse are 
collected, separated from air, and stored for return to earth. The commode 
uses a slinger and vacuum drive concept for feces storage. The bactericide 
for bacteria control in the urine is stored in a bladder tank. Air flow 
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leaving the urinal and commode passes through bacteria filters and charcoal 
canisters before reentering the cabin. This process provides odor and 
bacteria control to the entire vehicle. 

166 Simulation of the electrical loads, heat rejection/absorbtion, 

and water usage is required. 

4..-12,.,2...3 . Personal Hygiene 

166 For the seven-day mission, personal hygiene provisions will be a 

GFE kit stored in the waste management compartment. Space is available above 
the waste management system for installation of a hand wash basin and a 
more extensive personal hygiene system for extended missions. 

166 Simulation of the electrical loads, heat rejection/absorbtion, 

and water usage is required. 

4,12.2.4 Fire Detection and Extinguishing 

166 The fire control subsystem is located in the avionics bay and 

flight deck. The detection system consists of a light source, a gas filter 
interferometer, and a detection and localization logic similar to the Skylab 
system. Several gases can be monitored at once, and it can localize 
incipient fires or toxic elements. This system simultaneously serves as 
a fire detector and as a contaminant detector. It detects a problem before 
it represents a hazard to the crew. 

166 Different types of fire extinguishing 'systems are provided for 

the three avionics bays and for the crew compartment. The avionics bays 
are isolated and differential pressure regulators normally maintain the bays 
0.4 psig below cabin pressure. If a fire. occurs in the avionics bay, a 
high N 2 purge flow is introduced to reduce the 0 2 partial pressure below 
1.0 psia, extinguishing the fire in less than one minute. Operation of avioni 
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bay fans will effectively mix all the gases to give the minimum reaction 
time. The high gas flow into the bay will be vented overboard by the 
individual bay vent valve. The vent valve will operate between 14.7 
to 15.0 psia. 

The crew compartment will use four hand-operated portable, 
foam fire extinguishers. Each extinguisher is identical to that used 
in the.CSM. 

4.12.2.5 Extravehicular/Intravehicular Service and Recharge Station 

and Airlock 

Two portable life support systems (PISS) service stations are 
provided for two-man operations. Each station has provisions for water 
(for recharging the suit sublimator cooling system), oxygen and battery 
recharge, and oxygen open-loop prebreathing. To recharge the PLSS, a 
pump boosts the 900-psia oxygen supply to the 1500-psia PLSS oxygen storage 
tanks. The airlock will normally be repressurized from the cabin gas in 
less than five minutes by opening the airlock pressurization valve. 
Expendables are supplied for seven airlock repressurizations and PLSS 
recharges. 

4.12.3 Thermal Control 
4.12.3.1 Coolant Loops 

Figure 4-12.2 presents the coolant loops and design performance 
data. Water is used to cool the cabin because it is nontoxic. Freon 21 
cools the unpressurized areas because it has a low freezing point and 
viscosity. Thermal integration is accomplished in the Freon loop through 
interfaces with the environmental control subsystem, fuel cells, and 
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hydraulic systems. Up to 15,000 Btu/hr of Freon system heat transfers 
to the hydraulic fluid to maintain its temperature. Electrical heaters 
provide thermal control of other passive systems in space. Refer to 
Figure 4,12-3. 

Thermal control of the three avionics compartments (located 
in -the > crew- compartment) is accomplished by pi nf in coldplates and by air 
cooling systems of one of two parallel fans operating with a heat exchanger 
in each bay. The CSM-developed coldplates will be improved in durability 
by increasing the faceplate material thickness to reduce potential 
damage during normal maintenance procedures. 

4.12.3.2 Heat Sinks 

Space . radiators are the primary heat sink and can reject the 
maximum heat load without attitude constraints during all space operations. 
The water sublimator is the normal heat sink for boost and before and 
during reentry to 100,000 feet altitude, with system thermal lag absorbing 
heat between that altitude and the cruise condition. During atmospheric 
cruise (below 30,000 feet), vapor-compression cycle refrigeration systems 
reject the heat to ram air-cooled heat exchangers. Heat is rejected 
during ground operations through 6SE heat exchangers or the vapor-cycled 
systems. The radiator is a two-sided, deployable radiator consisting of 
eight modular panels stowable in the cargo bay -and enclosing the cargo 
space as a door. The radiator is in turn provided with a thermal protection 
cover or outer door during ascent, reentry, and recover conditions. 

The panels are constructed from aluminum, and the top panels are thermally 
isolated from the bottom panels. Figure 4.12-4 shows one side open. 
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exposing the cargo bay, and the other closed, protecting the cargo. In 
the open position the radiator has 726 square feet of effective area on 
the bottom side. The radiator is most efficient when in the deployed 
position, for heat can be rejected from both sides without supplemental 
cooling for all orbital mission phases and without attitude constraints. 

When the radiator is in the stowed position, the effective 
radiator area is 790 square feet and supplemental cooling will be required, 
using excess fuel cell water in the sublimator for the worst-case mission 
heat load and radiator attitude. The radiator coating has a solar absorptivi 
of 0.2 and an infrared emissivity of 0.92. 

4.12.3.3 Water Management 

The water management system stores, distributes, and disposes 
of potable water and collects and stores waste water. Potable water is 
stored in two tanks, each having a capacity of 100 pounds. It is supplied 
to the galley at temperatures of 150° and 45° f. When the potable storage 
tanks are fully charged, the system pressure will rise to 20 psi above 
cabin pressure. With continued fuel cell flow, the tanks will become full 
and normal disposal is accomplished by the water sublimator. For 
emergency, the water will be dumped overboard through two heated nozzles. 
Bacteria are controlled by processing potable water through silver ion 
generators. In the event the water from one of .the fuel cells should 
become contaminated, the water can be dumped directly overboard to bypass 
the potable system. Waste water condensate from the humidity control heat 
exchanger is stored in three tanks, each of 100 pounds capacity and normal 
operating pressure of 14.7 psia. 
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4.12.4 

Fault Detecti on Management 



166 The fault detection subsystem allows continuous monitoring of 

critical paths of the subsystems during flight and minimizes ground checkout 
procedures. The instrumentation will permit determination of redundant 
paths in flight and status of each line replaceable unit within the subsystems 
during ground checkout. Controls will isolate units or groups of units 
when an out-of- tolerance condition is detected. Notification of out-of- 
tolerance conditions will activate Caution and Warning system alarms and 
displays. 


166 


i 

1 



4.12.5 Ground and Launch Operations 

Postlanding cooling of the avionics equipment and cabin will be 
supplied by the ECLSS. System heat will be transferred to the GSE heat 
exchanger, which will be activated by connecting the ground coolant lines 
and electric power to the service connections. With ground power available 
to the vehicle, the vapor-cycle system will serve as a standby cooling 
system if the GSE coolant system is not operating or if it is not available. 
Prelaunch cooling will be provided by the GSE system through the upper 
swing arm to T-25. Subsequent to T-25 the vapor-cycle system will provide 
system cooling. 

4.12.6 Cabin Noise Level 

Special provisions have been incorporated in the design of the 
cabin systems to control noise level. The avionics bay doors and the noise- 
producing avionics equipment, such as the inverters and fans, are sound 
insulated. The cabin fan and water pump assemblies have been remotely 


< 
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166 located under the lower compartment floor away from living areas. The pump 

and fan incorporate local sound insulation and the duct system design 
contains sound absorbing baffles. Audio cues for these devices are not 
requi red. 

4.12.7 Corrosion and Contamination Control 

166 A program for corrosion and particulate contamination control will 

be employed for all ECLSS fluid systems. Stainless steel tubing and componen 
will be used in the water system loop and the potable and waste water 
system to reduce corrosion. The Freon system will be made of aluminum. 

4.12.8 Rationale 
Not required 

4.12.9 References 

166 Pages 3-135 to 3-142 I 
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4. 13 Payload Accommodation System 
4.13.1 Structural/Mechanical Interfaces 


4.13.1.1 General Structural Attachment 

The payload attachment mechanism Figure 4.13.1.1-1 consists 
of easily moved attachment fittings that can be placed at 14 
locations along the length of the bay. This design provides 
.felxtbility -for .payload -changes 'be-tween missions . -ATi-gnment 
of the payloads within 0.5 degrees of the orbiter's reference 
system is maintained by this system. 

i 



j } — , END VIEW 


FIGURE 4.13.1.1-1 PAYLOAD RETENTION 
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4.13.1.2 Payload Deployment/Retrieval 


Deployment and retrieval of payloads is provided by the 
general purpose remote manipulator system (RMS) illustrated 
in FIGURE 4.13.1.2-1. The system is adaptable for various 
payloads to perform multiple payload deployment, retrieval on 
a single orbit mission, and the docking/retrieval of light 
'-ma s s pay Toads . 

A payload is retrieved in three basic steps:- (1) transmission 
of commands for stabilization, orientation for manipulator 
attachment, retracting solar arryas, antenna, etc.*, (2) 
manipulator engagement, translation, and securing in the 
payload bay; and (3) connection of payload utilities, (e.g., 
caution/warning, power, data, and fluid/gas venting when 
required) . . 

These utilities are connected without EVA by the standard 
interface connections provided at the docking port and the 
payload bay access hatch. 

For multiple payloads having propulsive stages, actuation 
of interface connections remotely controlled from the 



FIGURE 4.13.1.2-1 

Manipulator Arms Adaptable to Multiple Payload Deployment and Retrieval 
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Shuttle orbital payload deployment and retrieval will be 
accomplished by two remotely controlled manipulator arms. The two identical 
50 foot long arms each possess shoulder, elbow, and wrist joints. The 
shoulder, located at the attachment point of the arm to the orbiter, 
possesses two rotational joints (pitch and yaw). The elbow, connected 
to- the shoulder by a '23% “foot long rigid tubular beam, possesses two 
rotational joints (roll and yaw). The wrist, connected to the elbow by 
a 23% foot long beam "forearm," possesses three rotational joints (yaw, 
pitch, and roll). The terminal device is connected to the wrist by a 
3 foot long beam. The standard terminal device will be a hand-type 
grasping mechanism, but special devices may be attached for particular 
mission. Each arm will weigh about 1000 pounds. Each arm is attached 
to the fuselage near the forward bulkhead of the payload bay. During 
launch and entry, the arms are stowed along the top of the payload bay. 

Each arm is extended, and attached at seven points to one of the payload 
doors, near the mating line between the doors. Each, arm is attached to 
a different door. When stowed, each arm occupies a cylindrical envelope. 

50 feet in length by 8 inches in diameter. The attachments must be 
released before opening the payload doors, and, the arms are ordinarily 
locked in them shortly after closing the doors. After the payload doors 
are opened, an arm deployment mechanism is actuated which raises the 
shoulders out of the payload bay and opens a 20 foot separation distance 
between them. The deployment mechanism must be retracted in order to 
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2, 9, close the doors. Electric motors and gear reducers located at each of 
10 

11 the seven rotational joints, plus the terminal device, provide torque 

1 to move the arm and terminal device. The selected motors have a maximum 

shaft power of 28 watts. Each joint uses two motors. If one motor 
1 fails, the joint can still be moved with full speed and torque capability. 

Each rotational joint has a brake, which is locked up whenever power 
to that joint is off (not powered up, or power failure). Each rotational 
joint also contains a potentiometer to measure angular position and a 
tachometer to measure angular rate. 

Control of the manipulator arm may be either automatic or 

13 manual. The on-board computer will be able to execute certain basic 

14 arm maneuvers itself. Manual control will be effected through a force- 

reflecting system. To provide both the coarse control helpful for 
positioning the arm in the approximate attitude desired, and the fine 

13 control necessary for delicate maneuvers, a variable-gain system was 
! chosen. For coarse control, angles transcribed by the manipulator arm j 

i 'I 

! and the controller will be equal. For fine control, angles transcribed * 

i 1 

by the controller will be 18 times as large as those transcribed by the 

manipulator^™. Interface between the controller and the manipulator 
I * 

arm will take place through the on-board computer, which will calculate 

the necessary transformations. 

A checkout system is provided to verify the condition of 

8 ami motors, tachometers, and potentiometers, before power is applied 

to the system. Upon selecting the desired device to be evaluated, a 

predetermined voltage is applied to it. The actual voltage accepted and 

returned is then available for display. Ordinarily, no motion will 
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result, since brakes are locked when the system is powered down. In 
case of certain failures, the checkout system may be used to move a 
joint independently. A switch will be provided to release the brake 
on a joint, thereby moving the joint when the checkout system applies 
electrical power. 

Sensory inputs to the crewman controlling the manipulator 
•■arm ^a re' 'provided "by the ‘force-reflecting 'controller, a window through 

15, 8 which the operator can see into the payload bay, and three TV monitors. 

,1 Four TV cameras are mounted in the payload bay - the operator chooses 

which three he wishes to monitor. Two floodlights are attached to each 
camera. One camera is mounted near the end of each arm (after wrist 

16 yaw and pitch joints, before wrist roll). Another TV camera is mounted 
at the base between the two manipulator arms. This camera can be used 
to automatically track the terminal device. Iris and focus control is 

17 provided for all cameras, as is a power switch. Both the fore and aft 
payload bay cameras can be zoomed as well. Both the aft and forward 
(when in manual mode - not automatic terminal device track) can be panned 
and tilted by the operator. Brightness, contrast, and test controls are 
provided on the crew station monitors. Resolution of at least 300 scan 
lines is provided by the TV system. 

In case of certain arm failures which would prevent closing 

1,2 of the payload doors, an explosive device will separate the failed 

manipulator arm from the vehicle, allowing the orbiter to be flown away 
from the derelict arm. 

Efficient manipulator arm design requires certain limitations 
on arm dynamics. Rotational joint design requires limitations on angular 


1 , 2 
6, 12 
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travel at each joint. Each joint is also torque limited to prevent 
damage to the manipulator arm. Travel limits and torque capability 
(based on 10 pounds maximum tip force) are: 




Angular Travel 

Torque (ft-lb) 

Shoulder 

Pitch 

±200° 

500 


yaw 

±130° 

• 500 

Elbow 

roll 

±200° 

. 350 


yaw 

±155° 

350 

Wrist 

yaw 

±120° 

150 


pitch 

±120° 

150 


roll 

±200° 

65 


Travel limits are enforced by mechanical stops and/or 
microswitches. Joints and the control system are designed so that 
6, 19 maximum tip position error is ±2 inches and maximum tip velocity error 
is ±.05 ft/sec. (excluding structural deflection under load). This 
requires an angular position accuracy of ±.113° and an angular rate 
| accuracy of ±.033 at each joint. This places requirements on the 

precision and frequency of arm control inputs recieved from the on-board 
20 computer. Angular position information will be exchanged between the 

| computer and the arms in 13 bits, every 20 to ’40 milliseconds. 

Structural deflection at maximum (10 pounds) tip force will 
not exceed 1 inch. 

The arm electric torque motors, controller torque motors, 

6, 21 and TV camera operate off 28 vdc. Floodlights will operate off 110 vac. 
22 

The largest electrical load is expected during payload unload and deploy. 
An average power demand of 1.008 KW is anticipated for a period of ten 
minutes during this process. 
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4.13.1.2.1 Rationale for Assumptions 
Not applicable. 

4.13.1.2.2 Data References 


1 . 

22 

pages VIII-1, VIII-2, VIII-7 

2. 

76 

page 4-371 

3. 

7 

page B.3-40; 13 pages 4-32, 4- 

4. 

22 

pages VIII-41, VI 11-43 

5. 

22 

pages VIII-6, VIII-89 

6. 

22 

pages X-2, X-3, X-4, X-5 

7. 

40 

page 177 

8. 

22 

pages VIII-9B, VIII-9C 

9. 

40 ' 

page 179 

10. 

22 

page VIII-21 

n. 

22 

page VIII -67 

12. 

22 

page VI 11-59 

13. 

22 

pages VIII-10, VIII-11 

14. 

7 

page B.3-77 

15. 

22 

pages VIII-89, VIII-90, VIII-91 

16. 

22 

page VII-11 

17. 

22 

pages VIII-95, VIII-96 

18. 

22 

pages VIII-1 06 through VI I I -11 0 

19. 

22 

page VIII-5 

20. 

22 

pages VI 1-24 , through VI 1-28 

21. 

16 

page 4-373 

22. 

22 

page VIII -65 

23. 

166 

pages 3-156 
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166 The baseline orbiter's time phased average power profile for a 
typical mission given in the EPS loading includes the specified 
payload requirement of 1000 watts average (1.5 kw peak) during 
all mission phases except the orbital operations phase where 
excess capability exists. This power is supplied to the payload 
bay and to the docking port in the form of regulated dc. 
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4;13.4 ‘Payload *A vTorr-ics Signal Interface 

l 66 The baseline configuration accommodated the majority of payload 
and has sufficient flexibility that between-flight changes will 
be required only for infrequent special missions. This flexibility 
is provided by simple design extensions of the basic avionics 
subsystems, and simplifies crew procedures, flight preparations, 
and payload adaptation. 


166 The orbiter communication system and the payload signal interface 

that is common to all payloads is shown in Figure 4.13.4-1. Except 
for the safety of flight signals (critical displays and safing 
discretes) which are routed to the forward flight station and the 
MSS, the individual selection, routing, and switching of payload 
signals is accomplished at the payload control panel of the MSS. 
Payload data communication flexibility is provided by multiple 
recorders, multiple transmission channels, general purpose alpha- 
numeric displays, and alterable memory computers. The junction and 
switches shown are repeated for simultaneous accommodation of up 
to five payloads. Digital commands from ground stations are 
encoded, and a payload data interleaver combines payload data for 
S inclusion with the normal 128 kilobits per second operational 

flight instrumentation OFI (Mode 1) transmission. When orbiter OFI 
is not transmitting (Mode 2), up to 256 kilobits per second payload 
digital data can be accommodated. 
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FIGURE 4.13.4-1 Payload Interface Signal Flow \ 

The MSS provides for managing orbi ter/payload interfaces and 
supporting operation of active payloads. The console houses most j 
of the payload signal support equipment. The MSS caution and warning 
system annunciates payload critical malfunctions and is intercon- 
nected with the flight deck performance monitor during periods when 
the payload computer is not operating or the MSS is not manned. 


The computational support system is required for status deter- 
mination, control, limited onboard checkout, initialization, data 
display, and gross verification of proper data transmission .for all 
payloads, and to support the manipulator arm control. The read-only 
tape memory enables the MDE to operate in either the payload signal 
processing or manipulator control mode, and provides for payload 
variation and program growth needs. Either of the payload data 
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4-205 


Area 

Payload Bay Environment 

Acoustics 

1 45-db interior overall sound pressure level 

Pressure 

Air vents control pressure to differential t 2.0 ps: 

Humidity 

Contamination: 

Nitrogen purge by GSE - dew point - 65 F 

Ground 

Payload bay liner, GSE purge 

On-orbit; 


H 2 0 

Hold for 2 days and dump* 

Waste 

Hold for 7 days 

Propellant 

RCS thrusters do not impinge on payload 
bay 

Material outgassing 

Material selection and design criteria per 
NASA guidelines (OMSF Handbook 8060.1) 

•Ice particles decay time due 0 drag and sublimation ^ 3 hr 


Table 4.13.5-1 


Payload Bay Environment 


m 

■a 

H 

■ 

Baseline Design 

High- 

Temperature 

Limit 

Baseline Design 

Prepunch 

■ +40°F 

GSE purge gas conditions bay to 75°F il04 for 
extreme 95% cold atmospheric temperatures (i.e., 
KSC: 44“F; WTR : 39 V F) 

+ 1204 

GSE purge gas conditions bay to 75°F ±1Q°F for 
extreme 95% hot atmospheric temperatures (i.e. 
KSC: 894; WTR: 88 °F). 

Launch 

+404 

Adiabatic payload fc3y wall will remain near pre- 
launch temperature 

+150°F 

Entry designs TPS; during launch, bay wall temper- 
ature rises a maximum of 18°F (i.e., 1034 
maximum) 

On-orbit 
(doors dosed) 

-1C0°F 

Insulation and radiators maintain temperature 
above minimum. 

+ 1504 

Extensive multidimensional analysis shows maximum 
temperatures less (nan 1204 

Entry and 
past landing 

-100°F 

Same as on-orbit minimum temperature 

+200°F 

Payload bay insulation designed to meet entry 
temperature requirements. 

Repressurization air cnoled to less than 200 'F 
by air vent heat sinks. 

Post-landing ground purge connection incorporated. 


Table 4.13.5-2 


Payload Bay Thermal Environment 
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166 recorders can be controlled at the payload control panel to play 
back data for ground transmission, subject to the bandwidth 
. limitations of the ground RF link. In addition to the installed 
equipment which can accommodate most payloads, the MSS incorporates 
space and modular installation provisions for additional unique 
displays and controls provided with special payloads. 

46.6 .A thre.e-.way .conference .voice is .available., as .are dedicated -di gi tal 
data channels and a time-shared (with orbiter TV) wide band ground 
downlink. Also, payload access to orbiter antennas is provided for 
ground checkout of transmission functions. 

4.13.5 Payload Environment Control 

166 The orbiter incorporates a payload heat exchanger in the ECLSS Freon 
loop to provide a minimum cooling capability to the payload of 5200 
Btu/hr. This exchanger is located near the payload bay service 
panel for convenient access for hookup during payload changes. 

166 Provisions within the orbiter ECLSS distribution system permit the 
installation of payload-supplied fans and ducting for atmosphere 

1 revitalization of pressurized payload modules. 

166 The characteristics of the environmental conditions in the payload 
bay are presented in TABLE 4.13.5-1. Thermal control provisions are 

~j presented in TABLE 4.13.5-2. In addition, the air vents provided 

for pressure control use heat sinks to cool incoming air during 
re-entry to 200°F. 

4.13.5.1 Rationale 
Not required 

4.13.5.2 Reference 

166 Pages 3-155 to 3-161 
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4.13.6 Payload Bay Door Mechanisms 

The door mechanism rotates axially while maintainino contour 
control between door segments. Bach co- linked segment is 
indeoendentl.y hinged to the fuselage longeron at three places 
and contains three latches on the door centerline edge. Latches 
also are located at the forward and aft carcio bav bulkheads. 

The latches first grasp and pull the door edges together against 
thermal distortions and the peripheral door-to-fuselage seals 
holding the door shut. To avoid large latch reaches, each latch 
actuates upon contact with its mating nin via a proximity sensor 
signal. The' latches have a zip-fastener action, initiating at 
the point of first contact; i.e., each latch will null the next 
adjacent latch into contact. This will continue even if one 
latch on each segment is failed or tripped. 

Each door segment is supported by either three idler hinges or 
two idler hinges and one powered hinge. There are four powered 
hinoes on each side of the orbiter. The four nov/e red hinnes are 
driven by a common torque shaft with redundant electric motors 
at each end of the shaft. Intermediate stcnning, provided through 
sequencing proximity switches, provides manipulator positioning 
and deployment and retrieval. The powered hinges are driven by 
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4.13.6 Payload Bay Door Mechanisms 

The door mechanism rotates axially while naintainino contour 
control between door segments. Each co- linked segment is 
independently hinged to the fuselage longeron at three places 
"and"Con tains- ‘three latches -on -the -doe reenter line edge. Latches 
also are located at the forward and aft cargo bay bulkheads. 

The latches first grasp and pull the door edges together against 
thermal distortions and the peripheral door-to-fuselaae seals 
holding the door shut. To avoid large latch reaches, each latch 
actuates upon contact with its mating nin via a proximity sensor 
signal. The latches have a zip-fastener action, initiating at 
the point of first contact; i.e., each latch will pull the next 
adjacent latch into contact. This will continue even if one 
latch on each segment is failed or tripped. 

Each door segment is supported by either three idler hinges or 
two idler hinges and one powered hinge. There are four powered 
hinges on each side of the orbiter. The four nowered hinges are 
driven by a common torque shaft with redundant electric motors 
at each end of the shaft. Intermediate stooping, provided through 
sequencing proximity switches, provides manipulator positioning 
and deployment and retrieval. The powered hinges are driven by 
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reversible jacks crew linear actuators. The reversible iackserews 
are used so horizontal nay load loading can be accomplished by 
simply disconnection the gear boxes from the drive torque shaft, 
allowing the remaining system connected to the door to free-wheel 
as the doors are opened through use of GSE. Reliability is 
designed into the system through the use of independent drive 
systems at each end of the drive torque shaft. A drive system 
is automatically declutched from the torque shaft in the event 
of failures resulting in its loss. 

4.13.6.1 Rationale 
Rot Required 

4.13.6.2 Reference 
166 Page 3-23 
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4.13.7 Rendezvous and Docking Sensors 

4.13.7.1 Reoui rements 


INC . 


PAGE NO. 


REP. NO. 


4-209 


22 


A. 

166 


The potenti ometers and tachometers mounted on the manipulator 
joints can also be utilized as rendezvous and docking sensors. 

••Normally , -they 'Provide angular position and velocity of each 
• joint to the on-board computer to close the force-feedback 
control loop. The on-board computer can calculate the exact 
position and velocity of the terminal device at any time with 
this information. After navload capture by the manipulator 
arm, knowing the position and velocity of the terminal device 
fixes the position and velocity of the target vehicle. 

4.13.7.2 Rationale for Assumptions 
Not applicable. 


4.13.7.3 References 


22 pn. II-4, VI 1 1-5, VII 1-6 



4.13.8 Payload Dedicated Recorders 

Two recorders are provided for payload wideband data and PCM 

data. The dedicated recorders and interface equipment v/i 11 be 

installed as reoui red as soecialized units at the mission 
specialist station. Additional recorders'may be transcribed or 
replaced during servicing of nayloads. On board reduction of 
these records is not reoui red; however, the recordings may be 
mounted and transmitted to the ground via the orbiter communication 


system. 

4.13.8.1 Rati onale 

There may be snecialized recorders on the nay load. 
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4.13.8.2 Pefe rences 

166 Pane 3-159 

4.13.9 Payload Handling Station 

The payload handling station is oquinned with five closed 
circuit television cameras (CCTV) and two monitors. In addition, 
the handler will have visual contact. Two CCTV cameras are 
located on the ends of the manipulator arms which insure a close 
image of the final matinn target. Two TV cameras are mounted 
in the payload bay to provide remote viewinn of the Payload 
attachment, release, and stowane operations. The fifth TV camera 
is used to help the operator align the payload during manipulator 
controlled' docking operations. 

4. 13. 9.1 Rationale 
Not required. 

4.13.9.2 Refe rences 

| , 7 • r ■- 166 page 3-159 and 3-160 ; ; 
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4.13.10 Payload/Bay Lighting 

The exterior lighting system fulfills the requirements for 
payload visual acquisition and tracking, determination of gross attitude, 
relative attitude and alignment, and gross range and ranoe rate durinq 
terminal .rendezvous., .docking., deployment., and .retrieval operations. Types 
of lamps and their locations are illustrated in FIGURE 4.13.10-1. 



APPLICATION 

GUANTITY 

TYPE 

0 ATTITUOE AMO RUNNING LIGHTS 

13 

LOW VOLTAGE AC. TUNtfSTEN-HALOGEN LAMPS. 

0 ACQUISITION. TRACKING. 

7 

XENON FLASHING - «MOOiFlEO APOLLOl 

W ANTI COLLISION LIGHTS 


' 

Q) DOCKING LIGHTS - SPOTLIGHT Ul 

7 

LOW VOLTAGE AC. TUNGSTEN-HALOGEN LAMPS. 

- FLOODLIGHT <c*» 

1 

LOW VOLTAGE AC. TUNGSTEN HALOGEN LAMP 

. 0 EVA LIGHTS* 

2 (OR 

LOW VOLTAGE AC. TUNGSTEN-HALOGEN LAMPS. 

AS REQMTS 
DICTATE) 

J00W4TTS 


0 PAYLOAO bay floodlights 

4 

7SWATT FLUORESCENT 

0 MANIPULATOR ARMS SPOTLIGHTS 

2 

LOW VOLTAGE AC. TUNGSTEN-HALOGEN. 
I0O 'WATTS 

0 LANOING LIGHTS* 

7 

70QK aCP QUARTZ, SEALED BEAM. 


* NOT SHOWN 


FIGURE 4.13.10-1 
ILLUMINATION FOR ALL SPACE 
LIGHTING CONDITIONS 
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4.1 6 Miscellaneous Systems 

This section includes those subsystems which are not described 
elsewhere in this document. 

4.1 6.1 Purge and Vent System 

The orbiter requires a controlled venting and purging through- 
out the vehicle because of hazardous fluids and gases, thermal heat 
dissipation, and air frame delta pressure limitation. 

The large quantities of on-board hazardous fluids and combustible 
gases dictate the use of an inert gas dilutant for purging airframe 
cavities. On the launch pad, prior to fueling, the vehicle undergoes 
an air purge furnished by GSE. When the vehicle is loaded, the airframe 
is then purged with GN 2 . Internal to the vehicle, the compartments are 
• isolated to avoid gas mixing and are provided with independent non- 
propul si ve vent ports. 

The vent ports are sized for maximum flow rate during the 
boost phase of flight. A two-position mechanically controlled non- 
propul si ve vent port having lanyard- type pull out plugs will be used to 
give the two stage orifice control required. 

Two feeders (top fuselage and bottom fuselage) are provided 
from the aft located GN 2 tanks for the purge system. This system will 
be manually controlled by the crew. 

4.1 6.1.1 Rationale for Assumptions 
Not required 

4.1 6.1.2 References 


166 Pages 3-22 
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4.16.2 Landing/Braking System 

The orbiter vehicle is equipped with a conventional tricycle 
landing gear system. Each set of gears is a dual wheel having hydraulic 
retraction and hydraulic/free-fall extension. The two main gears and 
nose gear have the same material construction and components as 
-conventional commercial aircraft. Each wheel has a folding drag brace, 
a gear activation system, up/down locks, and position indication system. 
The nose gear is equipped with a combination shimmy damper and steering 
system. Nose wheel limits are +30° either side of center. Turning radius 
of the vehicle is 116 feet. The main gear has an anti -skid brake system 
with locked-wheel protection at touchdown. Brakes and nose gear steering 
are electrically control -hydraul i c activators. Accumulators in the 
hydraulic system provide stored energy for towing and braking. 

Emergency fail-safe free-fall capability is provided without 
hydraulic power. 

The nose gear uses two 32x8.8 type VII tires at 200psi pressure. 
The main gear uses four 44.5x16 type 21 tires at 220 psi pressure. For 
ferry missions the main gear tire pressure will be increased to 250 psi. 

The braking system and the drogue parachute provide the 
capability to stop the vehicle within 6,000 feet on a dry runway and 
10,000 feet on a wet runway. 

The brake assembly is a carbon-on-carbon surface. The brakes 
are sized to provide five normal stops or to stop an orbiter during 
aborted takeoff without overheating. 
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The drogue chute assembly is basically a B52 main chute and 
an Apollo pilot chute and mortar assembly. 

For ferry flight, the static tire deflection is 32% of full 
travel. Maximum tire loading occurs during the horizontal takeoff roll 
when the el evon ..deflection -causes nose gear liftoff. Main gear deflection 
at this condition is 50% of maximum travel. 

For cross-wind landing, the gear is designed for a maximum 
ground wind speed of 35 knots. 

During in-orbit flight, the landing gear system and the drogue 
chute system will be thermally protected by passive insulation and electric 
heater blankets.. The design limit of the gear system is -60°F to 275°F. 

The nose gear is equipped with ground tow attachments. Simula- 
tion of the tow system is not required. 

4.16.3 Glide Brake System 

The orbiter vehicle employs an integral split rudder design which 

C( 

provides aerodynamic dra forces. The design is manually controlled and X 
may be adjusted for the amount of braking force required. 

The glide brake (or speed brake) system is normally deployed at 
250 knots airspeed at approximately 41,000 ft. During the landing glide 
and approach, the split rudder glide brake is deployed and modulated to 
control airspeed and glide range. 

The nominal glide brake setting is 40°. This setting may be 


varied to increase range/speed by closing the brake or to decrease range/ 
speed by opening the brake further. 
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A 100% glide brake setting on the control gives a 70° brake 
deployment - a 30% setting gives an angle of 20°, and a 40% setting 
gives an angle of 30°. 

4.16.3.1 References 

167 Page 4-5 .and 4-6 

4.16.3.2 Rationale for Assumptions 
Not required. 
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4.1 6.4 E jection Seat Mechanism 

Orbiters 1 and 2 w ill be equipped with two ejection seats 
for the Horizontal Flight Test phase and the first six manned orbital 7 
flight tests. 

The ejection seat will operate at dynamic pressures from zero 
-to a -maximum .of 650 .psf. <E-xisting -ejection seats which have zero altitude/ 
zero velocity performance capability will be used. 

The ejection sequence will separate the canopy hatch and remove 
it from the ejection path. The crew member will automatically be posi- 
tioned for safe ejection. The seat will then be ejected by a rocket- 
catapult blast through the canopy hatch. 

The ejection seat mechanism will be removed from the operational 

vehicle. 

4.1 6.4.1 Rationale 

Not required. 

4.1 6.4.2 References r 

166 Pages 2-2, 4-20, 7-11, 7-5, 7-3. 
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4.16.5 Dockino Mechanisn 

The orbiter docking mechanisn enmlovs a neuter docking concent. 
Figure 4.16.5-1 schematically illustrates this concent. It 
nresents the orbiter assembly and the corresponding docking 
element assembly. During the mission, the neuter active assembly 
is installed with its extendible tunnel retracted into the air 
lock. The tunnel extension provides the clearance for the docking 
operation. All docking elements will orovide a passive assembly 
that interfaces with the orbiter docking assemblies. 

The seals and latches are desinned to accommodate relatively large 
tolerances' accumulated from manufacturinc, thermal, and nressuriza 
tion distortions. The arrangement provides the capability for 
inspection and unscheduled maintenance and interface connector 
engaoement in a shirtsleeve atmosphere after a docking has been 

— ' ----- -accomplished. The total neuter assembly is contained within an 

80-inch-di ameter clear passage. Attenuation of docking forces is 

obtained by using a 10-inch stroke hydraulic shock unit. The 

i—~. standard utilities interface connectors are located around the 

40-inch diameter clear opening. This arrangement provides the 
flexibility for. renlacement and for mission configuration changes. 
Visual alignment aids and displays assist the crew in aligning 
the docking element within the accuracy required for mating. 

The passive docking assembly with an outward onenino hatch for the 
baseline orbiter configuration provides the capability to attach 
a payload to the docking port by utilizing the payload handling 
manipulator or to dock with other orbiting elements or an orbiter 
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vehicle. This tunnel assembly orovirles a minimum 36-inch 
clearance between the docking element and the orbiter and 
eliminates need of a loose dockino adapter. Separation and 


jettison provisions provide positive separation of the docking 
-assembly for emergency -or -contingency conditions. 



• REVERSIBLE FOR GROUND OPR 

' • SYNCHRONIZATION 

• tOAO SHARING 

• EASE Of REPLACEMENT 

• MODULAR INSTALLATION 

• COST EFFECTIVE BY MULTI USE 

DRIVE UNIT 

• DUAL ELECT MOTORS |M) 

• MULTIPLE POSITIONING 

• BRAKING 

• DECLUTCHING 

• REDUNDANT ORlVE 

• DUAL ORlVE SHAFTS 


NORMAL SEQUENCE 

FAILURE 

BACK-UP 

PiRST CONTACT 

li 

LOSE M2 

Mj REDUNDANCY 

2 ND CONTACT 

«-?. U 

LOSE Li 

L2.L4 CAPTURE 

Final contact 

«O.L 5 




Figure 4.16.5-1 

PAYLOAD DOOR ACTUATION AND LATCHING 
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4.17 On-Board Computer System 

The Shuttle Vehicle on-board Computer System is 
functionally divided into four semi-autonomous federated 
systems: the GN&C, the Performance Monitor, the 

Payload system, and the Main Engine Controllers. 

Key features of the on-board computer system are: 

166 o Computation tasks grouped and allocated for 

manageability, separation of high development 
activity, isolation of high traffic data from 
flight critical functions and ease of integration. 

© Display, keyboard and non GN&C computation 
functions mechanized in a single type, small 
computer augmented by tape mass memory, enables 
i | low development and equipment costs to satisfy 

redundancy requirements . 
o No direct exchange of data between computers 
performing redundant functions (multiple 
cross switching but no cross strapping), low data 
rate and non-interrupt transfer of data, memory 

i 

i 

protection. j 

l 

166 A block diagram of the on-board computer system is j 


shown in Figure 4.17-1. 
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Figure 4.17-1. Shuttle Vehicle On-Board 

Computer System and Interfaces 
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166 The input/output (I/O) Interface between the 

computers and the other vehicle subsystems is implemented 
using a modular design concept to provide the flexibility 
to accommodate changing requirements and permit early 
computer design. The modular display electronics I/O, 
computing, and display subassemblies are combined into 
a single unit, which permits a simple design and is 
feasible because the identified I/O channel requirements 
are primarily multiplexed, serial digital. The I/O to 
the GN&C computers is significantly more complex, and 
subject to change; therefore, these functions have been 
grouped into a separate unit identified as the GN&C 
I/O buffer. The I/O buffer provides the functions of 
signal conversion, multiplexing, and transfer of data 
to and from the computer memory. The transfer functions 
are accomplished by using a direct memory access (DMA) 
channel which operates independently of the CPU, except for : 
initialization. Modifications to the I/O buffer capabilities 
are accomplished by exchange of available standard modules 


61 

& 

42 


and/or where necessary exchanging custom I/O modules. The 
transmission of commands and data to and from the Main 
Engine Controllers will be via a dedicated serial interface 
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with DMA interface to controller computers. 

Guidance, Navigation , and Control (GN&C) System 

The primary GK&C system consists of three 64K 32-bit 
word computers dedicated to the solution and status of the 
Orbiter guidance, navigation, and control functions. 

The computers contain identical programs to allow a 
triple redundant computer system mode of operation. 

Data will be routed to each computer to allow 
program vote, average, or compare on input data. 

Output data will be voted, or compared, at the actuators 
rather than at the computer. 

The Performance Monitor System Modular Display 
Electronics (PM MDE’s) will contain backup G&N programs 
so that a "get me home” capability is available for all 
flight phases in the event of a generic software error 
or other critical system failures. Separate dedicated 
sensors and electronics are used with this, system. 

Display data for crew observation of the GN&C 
system performance and status is provided by the GN&C 


Modular Display Electronics (MDE) processors which are 
connected to CRT displays and keyboards. 
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The CRT's can operate in tabular alphanumeric, or 
graphic mode and contain an interactive selection feature 
for rapid indexing and data selection. Major display mode 
selection and manual data entry are accomplished via an 
associated keyboard. Switching is provided to permit 
.’Several .modes of -CRT./MBE interconnection for flexibility 
of access to different display generation programs 
which may be accommodated among the MDE's. 

Performance Monitor (PM) System 

The PM system consists of two MDE processors dedicated 
to the monitor and display of non-GN & C systems status or 
to the solution and display of the backup guidance and 
navigation function. One of the PM MDE processors capa- 
bilities is obtained by time sharing the center console 
GN & C MDE, between the GN & C display functions, the 
PM function, and the backup G & N functions. Reload 
of the MDE memory for a change of functions will be 
provided by a tape read-only memory under control of the 
crew. . 

Payload (PL) System 

The PL system consists of two MDE processors dedicated 
to the status, control, checkout, initialization, and 
display of payload data. The PL computers which contain 


J 
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identical programs will both be active but only one will 
be in control. The PL system will not be required to process 
onboard experiment data which will be either recorded on- 
board or transmitted to the ground for processing. Data 
.transmission and recording will .not require the PL computer 
participation. Memory growth capability for the PL 
computer system is provided by a dedicated read-only 
tape memory unit. 

Main Engine Controller 

The controller is a single integral electronics 
package mounted directly on each of the three main engines. 
The controller contains electronics for interfacing with 
the engine and the Vehicle with double and triple redundancy. 
;The controller also contains two independent . 16 bit . 

HDC-601 Digital Computers, each of which performs the 
computations necessary for full-authority closed-loop 
control of the engine thrust and mixture ratio in response 
to commands from the Vehicle and data from the engine 
sensors. 

Normally, Computer No. - 1 is in control and 
Computer No. 2 is in operational standby. In the event 
of a failure, control is automatically transferred to 
Computer No. 2 without impairing engine operation. 


u. 
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4.18 G'.'C.C Oa-Poard C eme nt or S Interlace System s 

4.18.1 GIw.C General Functional Description 

The GKScC subsystem (Figure 4.18.1-1) provides (1) automatic 
and manual control capability for all mission phases except 
docking, which is manual only; (2) guidance commands that drive 
control loops and provide steering displays for the crew; and 
(3) inertial navigation updated by star and horizon sensors for 
autonomous orbital flight and by RF navigation aids. for 
rendezvous, approach, and landing. Three independent redundant 
strings and a backup provide FO/FS redundancy. The equipment 
is divided into three subsystems: the aerodynamic stability 

augmentation (ASAS) ; the primary GK&C ; and the backup GN&C. 
Sensor requirements are found in table 4.18.1-2. Section 4.9 
discusses overall GN&C subsystem functional requirements. The 
various system control modes are summarized in Table 4.18.1-1. 

The basic aerodynamic stability of the orbiter is augmented by 
using the ASAS, an F-14 type conventional system that employs 
body mounted rate gyros and accelerometers. Gain scheduling is 
provided by inputs from a DC-10 type digital air data computer 
and deployable probes. Side stick rotation controllers, rudder 
pedals, and trim controls allow manual control, and the GN&C 
computer provides commands to the aerodynamic stability augmen- 
tation subsystem for automatic flight control functions, such 

•} j 

as automatic landing.. 
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Mode 

Flight Phase 

1 

1 Character i otic 

> ■-* ! 

Command 

. Boost/Insertion (IVC) 

Orb ita 1 (G MS , TVC , RCS) , 
Entry, Aero, Landing ; 

i ! 

f .Crew initiates guidance and ! 
1 control modes and monitors ! 
| control automatic through ; 
| GM&C computer, j 

Control 
- Stick 
| Steering 

i 

i 

\ 

j 

.Orbital (QMS IVC or RCS), 
Entry, Aero, Landing 

| i 

\ .Manual control and guidance 

i displays through GI’GC computer 
\ . Rate command, attitude hold, and 
RCS minimum impulse: RCS 
translation-acceleration command 

i Manual 

? 

i 

! 

.Aerodynamic 

.Manual control through ASAS j 

Rate command and damp j 

| Manual 

(backup) l 

| 

i 

.Boost/insertion(IVC) i 

Orbital (GMS TVC or 
RCS), Entry, Aero, 

Landing 

.Backup sensors and computer, ! 
Rate command and damp j 
.Direct RCS jet j 


Tab le 4.18-1-1 Control Modes 
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The primary GRocC provides guidance, navigation, and control 
for all flight phases with both automatic (command) and manual 
(control stick steering) inodes. The flight control loops used 
with the main engine and orbital maneuver subsystem (OMS) thrust 
vector controls, and the reaction control subsystem (RCS) are 
closed through the G!n&C computer; aerosurface control uses the 
computer and the AS AS . An additional manual mode for aero- 
dynamic flight control bypasses the computer and uses only the 
ASAS. Rate gyros and accelerometers provide sensing for 
damping and load relief. Attitude information is obtained from 
the inertial measurement unit (IKU) . Air data is provided by 
vehicle nose pressure ports at high altitudes, and by redundant 
probes deployed at lower altitudes. 

The backup GN&C subsystem provides a safe return capability 
for all flight phases. It is separate from the primary sub" 
system and uses dedicated sensors and electronics. Backup 
flight control is manual; rotation controller and rudder pedals 
inputs are used. The change from tip pods to body-mounted RCS 
jets eliminates severe control cross-coupling and alloxvs direct 
RCS control on-orbit as additional backup. Steering informatior 
for ascent, entry, and terminal area energy management is 
provided through visual interpretation of the backup G&N data or 
a cockpit cathode-ray tube (CRT) . Backup system alignment is 

accomplished by an optical sighting device, much like the CSM 
crewman’s optical alignment sight. 
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Currently, a gimbaled IKU provides the navigation reference 
with horizon aid star sensors for autonomous alignment and state 
vector update. During active rendezvous, TACAN is used for rang 
much as it is used in military air-to-air refueling operations. 
Range rate is derived from the range data in the GN&C computer. 

A star sens-or acquires a .target -light to provide bearing. 
Rendezvous with a passive target employs ground tracking of the 
target combined with orbiter on-board navigation and, when re- 
quired, range, range rate, and angle data from rendezvous sen- 
sors (considered part of the payload) . TACAN update is used to 
assure approach and landing path intercept above 10,000 feet 
altitude. 

Automatic landing is accomplished via a computed flight path 
generated in the GN&C computer using the inertial navigation 

system for reference xvith continuous updates from TACAN and 
instrument landing system (ILS) . Radar altimeter updates are 
used near etouchd own. The two segment (15-and3-degree) glide 
slope approach requires separate ground ILS transmitters for 
each segment. Rollout control similarly uses the GN&C computer 
and inertial navigation system with continuous ILS localizer 
updates. 

For all critical mission phases where automatic switching 
(i.e., allowable recovery times exceed pilot capability) is 
required, the three independent strings are operated in parallel 
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automatic detection and switching 
comparisons with a predetermined 


REP. NO. 

(Table 4 . 18 .1-3) . The require 
are accomplished through 
threshold. 
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4.18.2 G'-'-C System Elements A In te rface s 

This section provides detailed descriptions of the least 
replaceable units (LRU's) included in the GN&C system. 

The size and weight of the individual LRU's are included in 
Table 4.18.2-1. This table does not include the various displays, 
controls and navigational aids -which interface directly with the primar 
GlluC equipment. Table 4.18.2-2 contains a tabulation of the individual 
LRU power requirements by mission phase. Individual detailed LRU 
descriptions follow. 


P' 


LRU 

Air Data Package 
Attack Angle Transducers 
IKU & Power Supply 
Star Tracker and 
Control Unit 
Horizon Sensor (1) 

& H/S Reads (2) 

Rate Sensor 
Accelerometer 
GN&C Computer 
Prog I/O Processor 
Memory Unit (0) 

TVC Driver Unit 
MTVC Electronics 
Aero Control Elect. 

Speed Brake Driver 
APS Logic /Driver Unit 


Weight Volume 
Otv . Lb /T.RU Ft 3 /LRU 


3 

25 

0.52 

3 

10 

0.15 

3+3 

47 

0.80 

3+3 

10 

0.18 

3+6 

22 

0.20 

9 

1.5 

0.02 

6 

0.8 

0.01 

3 

40 

1.03 

3 

35 

1.03 

3 

30 

0.70 

3 

8 

0.12 

1 

6 

0.10 

3 

13 

0.29 

1 

6 .4 

0.10 

2 

19.6 

0.48 


55 


Total - 

Total 

It .-Lbs . 

Vol-Ft 

75 

1.56 

30 

0.45 

141 

2.40 

30 

0.54 

66 

0 .60 

13.5 

0.18 

4.8 

0.06 

120 

3.09 

105 

3.09 

90 

2.10 

24 

0.36 

6 

0.10 

39 

..... ;0 .87 

, 6 .4 

0.10 

30.2 

0.96 


789.9 lbs. 16.46 Ft 3 


Totals jGU&C LRUs 

Table 4.18.2-1 System Weight and Volume 
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4.18.2.1 Air Data Em ; j rro r ~i t 

The Air Data Equipment for shuttle has been selected for 


maximum use of existing equipment and permits a phased development- 
program . 

For the Mark I Orbiter, the horizontal flight control system 
requires only "the computation of dynamic pressure for gain scheduling 
of the stability augmentation system; displayed' parameters include 
altitude, altitude rate, mach number, and airspeed. These parameters 
are computed by the Air Data Package from input probe pressure signals 
corresponding to static and total pressures. 

The selection for Air Data Package is a modified version of 
the Honeywell Digital Air Data System designed for the BC-10. Utilizing 
a computer (7 CPU cards, 1 memory card) , this device converts pressure 

i 

signals to digital format, computes flight parameters, and produces 

both analog and parallel digital output to displays and to the aero- 
dynamic control electronics. 

Updating the Air Data System for the Mark II vehicle requires 
the addition of an Angle of Attack Transducer package , which produces 
digital outputs permitting computation of angle- of attack by the GN&C 
computer. This device consists of two differential pressure-to- 
electrical signal transducers and utilizes module building blocks in 
converting to the required digital outputs. 

Three each of the Air Data and Angle Transducer units are 
required in each system, for single-string redundancy in a spatially 
diverse vehicle layout. 
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4.18.2.2 Rate and Accelerometer Sensors 

Sensors for both the orbiter and booster vehicle GNScC system' 
include both body rate gyros and accelerometers for control loop 
stabilization . 

The hardware elements for both rate and acceleration sensors 
are based on existing equipment in current production by Honeywell for 
the Grumman F-14 flight control system. Available configurations in- 
clude both dual and triple redundant single-axis packages utilizing 
heater less GNAT gyros, and triple accelerometer packages. In applying 
the single-string system criterion of spatial diversity to the redundan 
gyros and accelerometers, subassemblies and circuits of the F-14 units 
will be. handled as building blocks in repackaged sensors bf four types: 
roll, yaw, and pitch body rate packages, and a 2-axis accelerometer 
package ; each LRU includes the inertial sensor, plus loop electronics 
and power supply. Separating rate sensors by axis is assumed to be 
required to permit locating the sensors at different airframe body 
stations because of vehicle bending mode variation by axis. 

4.18.2.3 I HU 

Each IMU consists of two LRU’s; the platform and the power 
supply. Both are shown in Figure 4.18.2-1. 

The platform has four gimbals with appropriate synchros, re- 
solvers and torque motors for each gimbal. The angular sequence 
starting with the inner gimbal is pitch, roll,, and yaw with the fourth 
gimbal providing redundant roll. The stable element (inner member) con- 
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tains two 2D0F gyros with SllA's directed along the pitch and yaw gimbal 
axes, respectively. One gyro controls the roll and yaw platform gimbals 
while the other controls the pitch gimbal axis. The platform baseline is 
typified by a K.earfott KT-70. 

The accelerometers, also mounted on the stable member, consist 
of a two axis accelerometer, measuring accelerations in the X and Z 
axis and a single axis accelerometer measuring Y axis accelerations. 

This definition applies. when the gimbal angles are driven to zero in 
all axis with respect to the vehicle body axis system. The coordinate 
system X, Y, Z, defined in the conventional sense, corresponds to the 
roll, pitch, and yaw axes of the vehicle. The gimbal torquing elec- 
tronics' and the accelerometer rebalance electronics are located in the 
platform assembly. 

4.18.2.4 Star Tracker System r 

The star tracker is a strapped down optical sensor using 
electronic gimbaling to determine star positions within the eight degree 
diameter f ield-of -view (FOV) . Usage of the tracker is extended to in- 
clude acquiring and tracking a space station light beacon. The acquisi- 
tion mode, results in a scan of the entire FOV after which the brightness 
object is selected. The tracker then enters a tracking mode in which 
the selected object is scanned over a very small FOV on the order of 
16 arc-minutes. The position of the object is measured in two axes 
with respect to the boresight of the tracker. 
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The star tracker (baseline is typified by the ITT Dual Mode 
Star Tracker) consists of an optical lens system, photosensor and elec- 
tronic circuitry as shown in Figure 4.18.2-2. The lens gathers and 
brings to focus the radiant energy from the source at the photo cathode 
of the multiplier phototube. The photo cathode surface forms an elec- 
tron image ^of t-he "focused light source. An accelerating voltage applied 
between the photo cathode and a limiting aperture causes electrons 
from a particular area of the £hoto cathode (instantaneous photo 
cathode area) to pass through the aperture. This then defines an 
instantaneous FOV of a small region in space. A multiplier section 
behind the aperture amplifies the signal. 

Deflection coils placed around the image section of the 
phototube provide a means of deflecting the electron image. A search 
sweep generator and a track sweep generator provide deflection signals t 
the coil to cause the electron image to sweep across the aperture during 
the acquisition and track modes, respectively. The search sweep 
generator is used t-cr scan the entire tracker FOV whereas the track sweep 
generator scans a small preselected area. 

The video amplifier and star selection circuits amplify the 
star presence signal, and set a reference level corresponding to the 
largest signal encountered in the FOV. On receipt of a tracking signal 
from mode control, the tracker scans the FOV and stops when the brightest 
star enters the instantaneous FOV. Once this happens, the tracker 
enters the tracking mode. The tracking loop circuits develop an analog 
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error signal which is used to control the deflection-soil signals so 
that the fine scan is centered on the star image. The output error 
amplifiers sample the deflection coil signal and provide output error 
signals to the computer. 


The power supply requires both plus and minus 27 vdc input 


power . 


The star tracker system is comprised of 3 LRU's: 
Star Tracker/Shuttler 

" Sun/Shield /Sun Sensor /Shutter Assembly 

Control Unit 


4.18.2.5 Horizon Sensor 


- The horizon sensor, used operationally during navigation is 
of the conical scan variety. The sensor approach uses two horizon 


sensing heads interfacing with a signal processing box. A block 
diagram of the sensing system is shown in Figure 4.18.2-3. 


Each head contains an optics section with a motor driven 
rotating mirror. A bolometer/amplifier provides a signal indicating 
the level of radiance received through the rotating FOV. A marked 
change in radiance levels indicates a horizon crossing. Under normal 
operation, two horizon sensor crossings per scan are received by each 
head. A motor packoff provides a reference timing signal which locates 

the center of each scan pattern. — . - 

Within the processor box, pitch information from each head 

is derived from the horizon crossing signals and the reference pulse. 
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The pitch information from each head is averaged to obtain a pitch angle 
output signal. A roll output signal is obtained by comparing the period 

of "Earth crossing" pulse from each head. — 

Radiance compensation circuitry is provided to suppress the 
effects of horizon anomalies on the output performance of the horizon 
..sensor. 

The horizon sensor, typified by the Barnes 13-156 Conical 

Scan Horizon Sensor System, provides a highly accurate, long life, local 
vertical reference over a wide range of altitudes (80 - 6000 nautical 
miles). The optics are designed to view the CO 2 special band (15 microns) 
which is the optimum spectral band for minimizing horizon variations. 

The output error angle signals are linear over a +5 degree region 
saturating at 10 degrees. A sun presence signal, detected in the short 
wavelength spectral band, inhibits the signal output thus preventing 
corruption of the navigation processing with erroneous updates. 

4.18.2.6 Analog SAS . 

The selection of an analog SAS shown in Figure 4.18.2-4 as 
opposed to a digital SAS was based on the fact that there are several 
flight proven and operational fail operative and fail safe analog flight 
control systems in use today. All aircraft currently flying employ 
this method of control. There is no production digital stability aug- 
mentation other than Apollo. Therefore, analog is tentatively selected 
as the conventional off-the-shelf approach in order to minimize risk 

i ; 

and be available for horizontal flight, ~ 


\ 
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Analog aerodynamic flight control electronics are packaged 
in three identical 3-axis LRU’s in adherence to the spatial diversity 
concept of redundant hardware independence. In each, thei pitch, roll 
and yaw control channels receive control commands from the GN&C computer 
and provide crossfed commands to the elevon control surface actuators, 
and in yaw channel from transducers in pedals. Capability also exists 
in the roll and pitch channels to provide surface actuation signals 
in response to analog manual input commands from transducers on the 
center control stick. Vehicle body rate and lateral and normal 
acceleration feedback signals are introduced for axis stabilization and 
a dynamic pressure signal from the air data system is used in each axis 
for gain scheduling. ; _ . .. . 

In addition to the control electronics and actuator servo 
amplifiers, each LRU includes an independent set of middle-select couir 
parators and the required power supplies. In packaging of the aero con- 
trol electronics, extensive use will be made of existing aircraft flight 
control hardware and packaging techniques. Plug-in circuit boards will 

Ve*. .... 

be modified from C-5 and F-14 hardware; wire-wrap interconnecting base 
plate and fabricated aluminum enclosure are adapted from the existirigg 
F-15 aircraft flight control electronics hardware . 

4.18.2.7 TVC Electronics 

Hardware for thrust vector control is packaged in four LRUs" 

3 identical TVC gimbal servo driver units and one manual TVC electronics 

box. • " "•'* .‘7 

Each of the TVC gimbal servo driver units contains 8 servo 
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amplifier circuits, middle select level detectors for redundancy 
management, and bias supplies, and Represents a single layer of redundant 

' 4 

drivers for the 8 engine gimbal actuators. Gimbal command inputs are 
accepted from either the GN&C computer in automatic control mode, or upcn 
manual switchover to manual TVC, from the MTVC electronics in a backup 
• mode.. 

The MTVC electronics unit accepts 3-axis commands from the 

two rotation hand controllers and body rate signals. Stick and rate 
inputs are amplified, and summed in an integrating amplifier; the re- 
sultant command signal outputs are fed to the appropriate gimbal servo 
drivers in each of the three TVC driver LRU’s. All of the TVC electro- 
nics hardware is new design, with circuits based on Apollo BG286 MTVC 
and BG288 servo amp background experience. Packaging will utilize 
plug-in circuit boards, wire wap interconnecting matrix, and non- 
hermetic aircraft-grade enclosure design of fabricated aluminum sheet, 

with thermal design based on convection cooling. - — 

4.18.2.8 APS Logic/Driver Unit 

Control of the ACPS thruster valve solenoids and of OMS engine 
ignition is handled by two APS Logic/Driver Units. Based on the existing 
Apollo Reaction Jet/Engine on-off control, this device accepts ACPS 
thrust commands from either the GN&C computer or from the Translation 
Hand Controller; it contains the logic necessary to select the appro- 
priate thruster in response to the commanded rotation or translation 
maneuver, and provides the switching circuits necessary for controlling 
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current to the thruster valve solenoids. This device also includes the 
necessary transient suppression and bias supply circuits, and circuits 
for OMS engine ignition and cutoff control. 

The unit will utilize the BG287 chassis as well as the basic 
existing welded matrix and cordwood module configuration. Growth space 
is adequate to a.c.commojdate revisions necessary to tailor .the existing 
jet select logic to shuttle ACPS system requirements, add one 2-jet 
driver module to the existing 16-jet control capability, and modify 
the SPS engine ignition timing and logic to meet shuttle OMS needs. 



{ 
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4.18.2.9 GN&C Computer Interface 

The GN&C computational facilities consist of three, single 
thread, dedicated data -acquisition strings and computers. At the pre- 
sent time, no provisions are being made to permit the transfer of data 
between computers. Figure 4.18.2-5 presents a simplified block diagram 
o'f the se Te*cted -concept . 

During the quiescent on-orbit periods, where the consequences ^ 

of a hard failure are minimal, only one GN&C string is used. In Table 
4.18 are the key features of the redundancy configuration. The 
failure recovery scheme is shown in FIGURE 4.18.1-1 and TABLE 4.18.1-3. 

Table 4.18.2-2 

Redundancy Management Key Features 


• Redundant strin-s interconnected only at I MU output and at the output 
force servos and jet drivers to maintain design simplicity. I:.*U inter- 
connection prevents divergence in guidance compute-ions and allows 
detection of slow degradation failures. Servo and jet driver intercon- 
nection (via monitor! required lor "fail-soft.” 

• RCS engines divided into 2 groups electron, icelly. each with dedicated 
GiN&C computer and capable of doing elt required maneuvers. 

• Hydraulic pressure monitors in the main engine TVC and aerosurface 
actuators automatically disengage a failed channel for first failure and 
switch to backup for second. O.'.iS IVC is not time-critical and does rot- 

* £, fequire a monitor. 

• When the b^cLup system is engaged, there are no significant transients 
requiring initial corrective piled inpu:s. Backup is rate command system 
that damps cut failure transients automatically with rotational con- 
troller centered. 

« Steering display command monitor delects guidance loop discrepancies 
for display; no suiomaiic action is initiated by this monitor. 

•Built-in test and self-test furnish LRU status to crew but are not used 
to automatically manage redundancy. 

• After a second failure, if the failed string can be isolated using BITE, 
control may be restored to the remaining good string at crew option. 
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4.18.2.9.1 GN&C I/O Buffer 


The input /output I/O interface between the computers and 
the other vehicle subsystems is implemented using a modular design con? 
cept to provide the flexibility to accommodate changing requirements and 
permit early computer design. The modular display electronics I/O, 
computing, and display .subassemblies are combined into a single unit, 


which permit's a simple design and is feasible because the identified 
I/O channel requirements are primarily multiplexed, serial digital. The 
I/O to the GN&C computers is significantly more complex, and subject to 
change; therefore, these functions have been grouped into a separate 
unit identified as the GN&C I/O buffer. The I/O buffer provides the 
functions of signal conversion, multiplexing, and transfer of data to 
and from the computer memory. The transfer functions are accomplished 
by using a direct memory access channel which operates independently 
of the CPU, except for initialization. Modifications to the I/O buffer 
capabilities are accomplished by exchange of available standard modules 
and/or where necessary exchanging custom I/O modules. The feasibility 
of this approach has been verified by detailed I/O interface studies 


• summarized in Table 4.18.2-3. 
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Table 4.18.2-3 



. input ■ (Output Buffer Suhxystem Interface Summary 


Interfacing 

Subsystem 

Signal 

fyo* 

Type of 
Interface 

Interface 

Device 

mm 

Rate 


Use 

GNiC 

Discrete 

Hardwire 

Standard 

291 

25 s/s 

St itus and control 

GNAC p* i loim; monitor and equipment control 


AC analog 

Hjtdwire 

Custom 

9 

1 ami ?5»/s 

Gi;nUI ?nr..':s 

Gu'daii-e and fi.pfif control computations 


Pulse 

Hardwire 

Custom 

23 

1 and 2$ s/s 

Accclci -meters, rate, gyros 

Gu'donce and flight control computations 


DC analc* 

Hardwire 

Standard 

47 

1 «r-d 2S s/S 

Slar angles. vertical errors, 
air data, commands 

Navigation and guidance computations, flight 
control 


Serial 

Hardwire 

MUX 

Semi custom 
Semi custom 

$ 

1 

25 s/s 
<5s/S 

Air data 
V’in enrine 

flight control computations 
Main trf.rsc contrcl and mritor 

Booster 

Oiscreic 

tlrrfwire 

Starvin'] 

3 

JSs/i 

n-rm- r— 

HrMV.fr r <ta*m wd discrete control 

Communication 

Discrete 

Hardwire 

Standard 

<5 

1 and 25 s/s 

SMfus. wnticl. ar.teruia 
switching commands 

Status, equipment control and switefurg 


Serial 

MIJX 

Semi custom 

? 

2 Kb/s 

Updila 

Ground data load 


Parallel 

Hardwire 

Custom 

6 

1 !/! 

Ran?,.* bearing 

Aero-navi ration guidance; orbital rendezvous 


DC anaring 

Hardwire 

Standvd 

*3 

?Ws 

Altitude;- pl.de slope 

-Autolarrd 

DSC 

Serial 

MUX 

Semi custom 

ID 

4.8K0/J 

AttMudc/trar, station 
commands 

Might control 

Off 


Hardwire 


■i 


Status and control 

Status, equipment control 


1 mTi 

MUX 


■I 

9 

Computed data 

Telemetry 


psm 

Hardwire 


■I 

SHi 

Time 

Mi<s*on/evei.t sequencing, navigation update 

■1 


MUX 

Semi custom 

12 

256 Kb/s 

Intercomputer data transfer 

Indirect transfer oi data between computers 
for reinitiali ration, support information, data 
etchan;e, and GMC display data (CRT ir.d 
annunciator) 


i/a- sample per second Kb/s — kilobits per second; WJX-«uUipkced 



r The GN&C I/O Buffer consists of two standard remote 


multiplexers and input buffer, and an output decoder. Data collected 
via the multiplexer /buffer will be, with very limited exceptions, 
already conditioned to a specified DC level. The decoder will be 
custom-designed to meet subsystem interface requirements. 

After signal conditioning has been performed, data from 

! ' ' i * . ! . ; i : 

the various subsystems is distributed to one o'f the two multiplexers. 
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The input data is multiplexed and routed to the buffer units of the 
computers. Each multiplexer accepts: (1) 96 discretes, (2) 1 serial 

data channel, (3) 80 high level analogs, and (4) 50 differential analog 
signals. The multiplexer's sample rate is under internal control; its 
output is 8-bit plus parity serial data. - 

The buffer units accept input data from the multiplexer at 
the bit rate programmed by the multiplexer programmable read only mem- 
ory. The buffer stores the input data in an internal memory. Each 
multiplexer input has a separate starting address. Two multiplexer 
channels are stored simultaneously (16 bits) . 

- - The buffers used in conjunction with the G&N computers 

receive data from the various subsystems via the multiplexers 
described above. Using input data and the stored program, the computer 
system performs the required G&N functions. Computer outputs are 
obtained either under direct software control or under decoder control 
via direct memory address through the parallel channel. Nominal decoder 
output capacity is as follows: (1) 15 serial signals, (2) 100 analog 

signals, and (3) 200 discretes. 

4.18.2.9.2 Remote Multiplexing Unit (RMU) 

. . The selected multiplexer is typified by an off-the-shelf 

Teledyne Remote Multiplexer Unit (RMU) Model DS-704 with minor modifi- 
cations. The RMU is the device which interfaces the user subsystems to 
the GN&C computers, via the appropriate Buffer Unit. It consists of 

a time division multiplexer, A/D converter, programmable read only 
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memory, and the necessary control/timing logic and modulator circuitry 
required to output multiplexed subsystem data into a PCM format for 
transmission to the Buffer Units;. The modification required is the 
addition of a serial digital input channel(s) . 

The following is a description of the functional capabili- 

•'tires of the *RMU*: 

Inputs : 

. High level ^00 to +5 VDC) analog: 80 single ended channels 
Low/High Level Analog: 50 differential channels 

. Discretes: 96 points ... 

. Serial Digital: Total input capability is limited to 

142 equivalent 8 bit words, i.e.. Analog Input * 1-8 
bit word, 8 discrete inputs * 1-8 bit word. The number 

of serial digital 8 bit words inputted to the RMU will 

subtract from the existing analog/discrete capability, 

...... . i.e., - 1 serial digital word block consisting of 142- 

8 bit words would delete^any analog/discrete input 
- • capability for that RMU. 

. Format Select: Two lines specifying one of four formats to 

be read from the programmable read only memory. 

. Power: +28 +10% VDC @ 400 ma . 

Outputs : 

. Data Output: 9 bit (8 bit + parity) words being transmitted 
■ - at approximately 30 Kbps with Bi-phase - L Modulation. 
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Functional Operation The RMU will operate according to 
the mode stored in the programmable read only memory and selected by 
the Format Select lines.. Figure 4.18.2-6 presents a simplified 
functional block diagram of the RMU . One of four modes can be externall 
selected which specify: output bit rate, input channel selection, out- 

put modulation, output word length, and gain selection for the differ- 
ential analog input channels. The RMU will then scan the appropriate 
... input channels, perform the required A/D conversion for formatting, 
add the necessary parity, modulate the resulting serial data stream, 
and output this data stream for transmission to the appropriate Buffer 
Unit . 

- - Functional Configuration Two functional RMU's are pro- 
vided within one case. These RMU’s may be used redundantly by external 
crossstrapping or to expand the total number of input channels. 

Physical Characteristics (for Dual RMU'.s) 

Power: 20 Watts (both units ON) 

Weight: 10 lbs. 

Dimensions: - 8.5 H x 4.5 W x 3.5 L (Preliminary est.) 

Volume: 0.08 cu. ft. 

4.18.2.9.3 Input Buffer 

The input buffer contains all of the circuitry and storage 
necessary to accept, decommutate, and store the inputs from four multi- 
plexers which are outputting serial data streams. In the baseline 
system only two will be used. The multiplexers are free running and 
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Figure 2. 18.2-6 

SIMPLIFIED BLOCK DIAGRAM, REMOTE MULTIPLEXER 
(TELEDYNE DS-704) 
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operating asynchronously. As each pair of words of data are received, 
from a multiplexer channel, the data will be transferred to a pre- 
determined location of core storage in the buffer unit, or the computer. 


In addition to the four PCM input channels, provisions will 
be made to custom interface, on an exception basis, those specific in- 
puts where significant cost savings may accrue. Typical candidates 
for consideration are data inputs from TACAN and Up-Data Link equipments. 

The input buffer for the GN&C computers will have a buffer- 
computer interface compatible with the computer parallel Direct Memory 
Access (DMA) channel. The computers will initiate data fetches from the 
buffer under control of software. By use of an I/O call, a starting 
buffer address and word count will be transferred and then sequential 
fetches of up to 24 locations will begin. Transfers from the buffer 
core to main memory will take place cvia DMA. 

A simplified block diagram of the input buffer is shown 
in Figure 4.18.2-7. 

Physical Characteristic s 
Weight 24 lbs. 

Dimensions: 4.1 H x 10.1 W x 15.5D 

: Volume: 0.25 - 

Power : 100 watts 
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4.18.2.9.4 Output Decoder 

The output decoder provides a means of distributing and/or 

»r« 

formatting the G&N computer output. The output decoder has the 

following capabilities. . — 

. 16 independent serial channels - each serial channel is 


Toa^ed via a direct 1/0 Instruction 

V 

. 128 discretes (0-5 ) - four fixed main memory locations 

are fetched via the DMA at selected intervals and their 
contents are used to update the discrete outputs. 

v 

. 64 DC analogs (0-5 @ 8 bit accuracy) - 16 fixed main 

memory locations (4 outputs per location) are fetched via 
the DMA at selected intervals and their contents are 
used to update the digital ta analog converters. 

. Gyro Pulse Torque Commands to gyro - a three-channel 
gyro pulse torquer converts command signals from the com- 
- puter to precise binary torque pulses which may be used 
to drive the gyro packages. Each pulse delivered to 
the gyro represents an increment of angle at the gyro 
input axis. 

. 48 bit register to telemetry - one and one half fixed 

memory locations are fetched via the DMA at software 
controlled intervals and their contents are used to 
reload the 48 bit register. The register is made avail- 

~ able for periodic sampling by the telemetry data 
acquistion system. 
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The Output Decoder interfaces with the parallel DMA channel 

of the computer. The DMA facilities of the computer are shared with 
• * ** 
the Input Buffer. 

Figure 4.18.2-8 depicts a simplified block diagram of typic 
functional paths which may be provided by the Output Decoder. 

Phvs i-cal ehara’Cteri'Sti'CS 


Weight: 27 lbs. 

Dimensions: 4.1 H x 10.1 W x 15.5 D 

YVolume: 0.25 

Power: 80 watts 
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4.18.3 GN&C Computer System 

The GN&C system consists of three 64K 32-bit word computers 
dedicated to the solution and status of the Orbiter guidance, 
navigation, and control functions. The computers contain identical 
programs to allow a triple redundant computer system mode of oper- 
ation. The computer clocks will be phase locked to the master 
timing unit to provide an inherent computer synchronization capa- 
bility. 


The GN&C program also provides navigation and guidance 
data to the Booster control computer and provides the control 
program for the manipu la tori. arms. 


Although the final choice for the GN&C computer has not 
yet been made, there are at present two candidates for the GN&C 
computer for the Orbiter. One is the Model AP-1 (designated AP-101 
for the Space Shuttle) manufactured by IBM Corporation. The other 
candidate is the SKC-2000 manufactured by the Kearfott Division 
of The Singer Company. 


The Model AP-1 Computer 


The IBM System/4Pi, Model AP-1 computer is a medium-sized, high- 
speed, general-purpose computer for real-time space and military 
control use. A standardized parallel channel and AGE interfaces 
permit the AP-1 to be integrated into an optimum system design 
with other Advanced System/4Pi computers. A summary of AP-1 
characteristics follows. 


The AP-1 has a full parallel 32-bit word machine organization. Data transfers to and 
. from main storage and the I/O are handled on a fullword basis as well. The architecture 
provides addressing of each 16-bit storage halfword, thus allowing both 16-bit and 32-bit 
i operands to be processed. This, together with the short and long format instructions (16 

and 32 bits), significantly increases the overall storage efficiency- of the AP-1 computer. 

. It further expands the applicability of the AP-1 to a wide range of problems, since most ; 

; uses require only 16-bit precision in the operands.' Navigation and similar high precision j 

1 computations are effectively addressed using 32-bit operands. The short format instruc- I 

tion, 16 bits, provides a similar advantage, because more than 70% of the instructions in a i 

typical application program may be of the short format. I 


< 


4 


u. 
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r— — — ‘AP-1 Functional Characteristics 

Machine Organization 
Type 

Organization 
Data Flow 
Data Word Length 
Instruction Word Length * 

Average Instruction 
Execution Rate 
'GeneraFRegisters 

Main Storage 
Type 

Capacity 16,384; 32,768; or 49,152 18-bit halfwords (including 1 parity 

bit and 1 store-protect (optional) bit) 

Modularity 8,192 18-bit halfwords per pluggable page 

; 1/0 

J Serial Channels Four channels; transformer coupled, two-way party line, 15 de- 

vices per channel; 1-MHz bit rate; 45,000 1 6-bit halfwords per 
second per channel 

One channel; multiple devices; 16 bits transfer; 150,000 to 
750,000 halfwords/second 

16 internal and external interrupts; 9 levels of priority; maskable 
12 DC-coupled inputs; 9 DC-coupled and 3 relay-controlled outputs 

Monolithic integrated 
TTL and MSI 

Flatpacks; 14, 16, and 24 leads 


115/200 VAC, 3 phase, 400 Hz OR. 28 VDC 
250 W (32 K halfword main storage) 

Overvoltage and overcurrent protection; transient protection; 
power sequencing 

0.87 ft 3 - 

40 lb (32 K halfword main storage) 

Meets or exceeds MIL-E-5400, Class 2X 


Parallel Channel (option) 

Interrupts 
■ Discretes 

Logic Circuits 
Class 
Type 
Package 

Power System 
. Primary Power 
Power 
Features 

Physical 

Volume 

Weight 

Environment 


General purpose, stored program, parallel 
Binary, fixed point, fractional 
32-bit parallel 
32 bits 

1 6 and 32 bits 

450,000 operations/second +0 5 50,000 
Two selectable sets of eight'32-bit hardware registers 

Random access, nonvolatile, destructive readout core 
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A block diagram of the AP-1 computer is shown below. 

r iis .'200 V I 

3 Phase. 400 He I 




Support 

Programming 

System 


♦5, *5. *12 V DC 


! 


Control Lines 


f* Storage E Kpanston *"] 

r- — — i » r 

8< — gK — - — 8K . 

^Cata.i32.bits> , Tim>nq ^ *.7 bit 1 1 7 b<t ^ 17 g 

][ p age 3K I 3< | 8K 1 

17 bit j — | >7 b«t - — 17 b<t | 

1 L I 


Optional 


I/O 


Serial 

Channel 


Logic 


Channels 


Discretes & 

Inippfvots 


Serial Data 

Bus (4> 


I 


4.18.3-1 AP- 1 Functional Block Diagram 


Type 

Number system 
Operation 
Data word length 
Instruction word length 
Instruction set 
Typical execution times 


Average instruction 
execution rate 


General registers 


— CPU Characteristics » — — : 

General-purpose, stored program, simplex - 4 SeTS op 
GCNH-nAL RoGiSreP.^ 

Binary, fixed-point, two's complement, fractional 
Full parallel 

32 bit fullword, including sign 
16 or 32 bits 

A D-IOt 

.42 short (16 bits) and 41 long (32 bits) ^ //7 tttsrr. 


Storage to 
Register (/is) 


Register to 
Register (jrs) 


Add 2.0 1.2 

Multiply 6.6 5.4 6.0 

Divide . 10.6 10.0 

AF-lol 

Over 450,000 instructions per second using typical instruc- 
tion mix (68% add or equivalent, 18% branch, 5% multiply, 
1% divide, 8% miscellaneous) (AP-lot 5^ c / cco'y 

Two selectable sets of eight 32-bit hardware registers; in each 
set, all are usable as accumulators, seven are usable as index 
registers, and four are usable as base registers 
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Instructions 

The five basic instruction formats shown below allow most operations to be coded in 
either a halfword or fuilword instruction. The halfword format instructions not only pro- 
vide increased throughput, by means of the instruction-look-ahead feature of the AP-1, 
but significantly improve the storage efficiency of the computer. Improved storage ef- 
ficiency means decreased storage capacity requirements for operational programs, since 
typical applications have consistently demonstrated that the short format (16-bit) in- 
structions account for over 70% of the instructions used. The AP-1 Assembler program 
automatically optimizes the object program by selecting the short format instruction 
whenever feasible. 


OP 

1(11 

R1 
1 1 



1110 01 

1 -1 .1 ! 1 

R2 








OP 

till 

R1 

1 i 

DISP 
1 ! ' 1 

. 

id 








OP; 

-1 1 1 1 

R1 
1 1 

1111 

1 1 1 

b b 

82 

1 

ADDRESS SPECIFICATIONS 
1 1 1 1 1 1 1 1 1 ! I I 1 1 1 

OP 

1 1 1 1 

OPX 
-i ■■(- 

DISP. 

L 1 1 1 l 

E 



OP 

OPX 

DISP 

B2 

MASK 


_1_ i—JLI .. 

1 1 

II1M 



1 .1 l.L L.L-1JLJ.1. 

,1. 1-1-1 ,1.„ 


RR (Register to Register) 

SRS (Short Register to Storage) 

LRX (Long Indexable Register to Storage) 

SSS (Short Storage to Storage) 

LSS (Long Storage to Storage) 


OP and OPX Operation code and operation code extension 

R General register designation 

DISP Displacement field 

8 Base register designation 

bb Addressing mode 



i- 
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The AP-1 general-purpose computer features an efficient instruction set, resulting in low 
main storage overhead and high throughput. A comprehensive set of halfword and full- 
word instructions are provided for arithmetic, logical, bit manipulating, data formatting, 
and input/output operations. Extended mnemonics for the Branch-on-Condition instruc- 
tion aid in simplifying programmer source coding. 




AP-1 Insi 

truction Set 








Typical Execution Time 



Format 



Instruction Type 

Basic Instruction 

(SRS) tps) 

RR 

SRS 

LRX 

SSS 

LSS 


Arithmetic 

Add 

2.00 0'^ 

X 

X 

X 





Compare 


X 

X 

X 





Divide 

10.75 (8.6) 

X 

X 

X 



- . .. 


Load 

2.00 

X 

X 

X 





Modify Storage 

312 / \ 





X 



Multiply 

6.75 

X 

X 

X 



.. .. ... 


Store 

Subtract 

2.00 

3.12 tu *V ei 

X 

X 

X 

X 

X 





Tally Down 




X 



Logical 

AND 

2.00 

X 

X 

X 





Exclusive OR 

2.00 

X 

X 

X 





» OR 

2.00 

X 

X 

X 





OR Bits 

3.12 





X 



OR Halfword 

3.12 




X 




Test Bits 

2.75 





X 




Test Halfword 
Zero Bits 

2.75 

3.12 




X 

X 



Zero Halfword 

3.12 




X 



Branch 

Branch and Link 

1.37 

X 

X 

X 





Branch on Condition 

1.37 

X 

X 

X 



.... 


Branch on Count 
Branch on Overflow 

1.62 

X 

X 

X 





• 

& Carry 

1-37 , 

X 

X 

X 



- - . • 

Shift 

Normalize and Count 
Shift Left Single & 

1.32+ n/4 

X 


• • 




. 

Double Logical - 

1.87 + n/4 


X 




- 


Shift Right Single & 









Double Arithmetic 







..... 


& Logical 

1.87 + n/4 - 


X 





Input/Output 

•In 

1.87 



X 





• Load AGE 

2.00 


X 

x . 





Out 

2.12 



x 




System Instruc- 

Load Multiple 

10.37 


X 

X 




tions 

Load PSW 

2.25 


X 

X 





Load. System Mask 

2.25 

X 

X 

X 





Store Multiple 

10.12 


X 

X 
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Organization 

The organization of the AP-1 computer offers very versatile addressing. The addressing 
technique accommodates 65,536 halfword addresses in the main storage. The generation 
of Storage Operand Effective Address is a function of the instruction format; and offers 
; short or extended displacement addressing, direct and indirect indexed address, and im- 
mediate operands. 


The AP-1 computer contains two selectable sets of eight 32-bit general registers, which 
•I .may.be .used. ^..accumulators, for fractional ..binary arithmetic; for logical and.shifting op- 
erations; or as base registers, index registers, or temporary storage. 

r . 

j Interrupt handling normally requires a put-away routine and a storage area to save the 
general registers whenever an interrupt servicing routine is entered; Then the registers must 
. j be restored at the end of the interrupt routine. Assigning one set of the general registers 
to interrupt (executive) routines and the other set to the problem programs gives an im- 
' provement in throughput and storage efficiency. Alternatively, in a multiprogramming 
— environment, assignment of the general register sets among the problem programs may 
produce even greater throughput. 

Main Storage 


— - - Main Storage Features ■ ■ ■ — 

Type Ferrite magnetic core, nonvolatile, random access, destructive read- 

out 

Capacity Choice of 1 6.384; 32,768; or 49,152 18-bit halfwords, including 

1 parity bit and 1 store protect bit, for the optional store protect 
feature, within the existing structure. A slightly larger structure 
will accommodate 65,536 halfwords 

Modularity 8192 18-bit words 

Cycle time 1 ps write or read/restore > 9 CO ft S AP~!°t 

Access time 450 ns > 

Electronics Monolithic 

Special features Power transient protection, separate sens© winding, 2-1/2D Organ- 

ization, temperature compensation 


! A militarized, 1-ps core storage array organized in a 2-1/2D addressing scheme forms the 
! basis for the AP-1 main storage, which is implemented primarily with monolithic circuits 
on two unique page types: an 8 K X 18-bit storage page and a timing page. The storage 
page contains 8/13 mil,* wide-temperature-range, ferrite cores with self-contained, temper- 
1 ature-compensated voltage regulators, address drivers, sense amplifiers, and a storage data 
register. A single timing page can handle up to eight storage pages, providing 8 K X 18- 
i bit modularity up to a maximum of 64 K halfwords of storage. No adjustments are re- 
• ! quired to provide complete interchangeability of the pluggable modules. 
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Input/Output 

. High-speed internal operations, coupled with a versatile serial and/or parallel input/output, 
provide for excellent throughput The four-channel multiplex serial I/O services up to 15 
peripheral devices per channel at a data rate of 1 megabit per second. The data-handling ca- 
pacity of each transformer-coupled, party-line, serial data bus may be up to 45,000 half- 
words per second, depending on the amount of data blocking. 


Serial channel 

Data Interface 
Maximum data transfer rate 


Parallel channel (Option) 


Data interface - 

Maximum data transfer rate 
Features 


Discrete inputs (typical) 

Discrete outputs (typical) 

Program loadable/readable 
counters 

lnterrupts^(P/pical) 


- I/O Characteristics — — 

Direct memory access; four multiplexed I/O channels; 
up to 15 devices per channel 

Serial, 1 MHz, transformer-coupled (70-ft lines) 

45.000 halfwords per second per channel ' . 

180.000 halfwords per second for 4 channels 

Direct memory access, externally controlled, 750,000 
halfwords per second, maximum 

Buffered I/O, externally controlled, 480,000 halfwords 
per second, maximum 

Direct I/O, program controlled, 240,000 halfwords per 
second, maximum 

16 bits plus address and control, single-ended TTL 
interface 

240.000 to 750,000 data words per second 

Channel-to-channel interface 

Externally specified channel-control-word chaining on 
buffered I/O 

12, DC coupled 

12: 3 relay controlled; 9 DC coupled 

Two 6-second counters with 100-ps resolution; one 
3-second counter with 50-ps resolution 

12 internal and 4 external; 9 levels of priority with 
program mask control 








DATE 10-20-72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE NO. 4-269 

REV. 

BINGHAMTON. NEW YORK 

REP. NO. 


Transformer coupling and the sinusoidal Manchester phase-coded signals provide data 

transmission reliability not possible with direct-coupled DC lines. ,The AP-1 transmission 
lines can withstand a short or an open without affecting data transmission. This is par- 
ticularly desirable in a party-line I/O system. An unterminated line design allows remov- 
ing units without disrupting operation of the line. 

Each serial channel is initialized separately by a program instruction. Facilities exist to 
permit block transfer of data words and to provide for chaining blocks of data. Data and 
control words are transferred to and from the CPU general registers or main storage. Per- 
‘ipherals^respondonly-when-aselect-eode^eommands^a-response. 

i An optional multiplex interface module (MIM) can provide a compatible interface be- 

' tween an I/O device and the serial channel. One version of the MIM (shown in the serial 
I/O application diagram) features a back-up channel for improved I/O reliability, parity 
checking and generation, peripheral unit selection logic, parallel-to-serial data formatting, - 
and automatic gain control to assure uniform data amplitude during transmission. 

! 



Figure 4.18.3-2 

Typical serial channel application shown for channel 1 primary and channel 2 backup. 
Four channels are available. 
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Designed for inclusion in each peripheral I/O device, the MIM connects the serial bus in- 
terface to a parallel TTL interface, and includes the control lines necessary to service most 
I/O devices. 

The I/O capacity of the AP-1 may be increased by adding an optional high-speed parallel 
channel. This parallel channel may be used with, or in place of the serial channel in ap- 
.. . plications requiring support of such high-speed I/O devices as the IBM System/4 Pi Drum 
Mass Memory, 

'<lnput*and‘Output data.'busses'provide -transfer of data^unidirectionaily to the peripheral 
devices. The parallel channel interface has been standardized to assure I/O compatibility 
with other computers of the Advanced System/4 Pi family, such as the SP-1. 

The parallel channel can support four devices, each of which may be an I/O unit, such as 
a drum or magnetic tape unit, or a control unit. Each control unit may interface with as 
many as 127 I/O devices, giving the AP-1 excellent and versatile I/O support potential. 


AP-1 Computer 



Figure 4.18.3-3 


Typical parallel channel application, showing direct device attachment (drum) and control units with 
with maximum number of peripherals attached. 
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Three I/O modes are provided for transfer of data and command functions between the 
AP-1 computer and peripheral equipment: * 

1) Direct Memory Access (DMA) I/O - The I/O device supplies a 16-bit main 
storage address, and 16 bits of data are written into or read from the storage 
location. DMA I/O is device initiated. A CPU lockout feature significantly 
Increases the data rate to a maximum of 750,000 halfwords per. second. 

2) Buffered I/O — The I/O device provides an "address tag", used to access a 
channel control wOrd'(CCW) containing count and address; a single word or 

i a block of data words are written into or read from main storage. Buffered 

I/O is device initiated. A maximum data rate of 480,000 halfwords per sec- 
i ond may be reached when the CPU is locked out. 

1 ' 

3) Direct I/O - Under control of the CPU instruction stream, a command is 
sent to an I/O device, and one word (16-bits) of data is written into or read 
from the device. Direct I/O is program initiated. The data rate is a function 

1 of the operation following the transfer and may be as high as 240,000 half- 

words per second. 

j * • 

^ ■ 

in addition to high speed, the AP-1 parallel channel provides several features for expanded 
performance. Most significant is the channel-to-channel interface, which permits the AP-1 
to transfer data to or from another member of the advanced System/4 Pi family, such as 
the SP-1 or another AP-1. The AP-1 channel, although faster than the SP-1 channel due to 
the higher main storage speed, is compatible with the SP-1, thereby permitting communi- 
cation between the AP-1 and the SP-1. 

Being able to externally chain two channel-control words while in the Buffered I/O 
mode increases the length of the data block that may be transferred. Provisions for an ex- 
panded controPword for Direct I/O enhance the number of different I/O functions or 
transfers that may be performed. 

■ A priority interrupt system is implemented with full masking capability for nine levels. 

Four external interrupts and 12 internal interrupts automatically store the current pro- 
* gram status word in an assigned main storage location and begin an interrupt servicing 
j routine. The internal interrupts include arithmetic conditions, time, machine errors, and 
I/O termination interrupts. 

Three program-loadable/readable counters are provided in the I/O logic of the AP-1. One 
of these is used principally to implement I/O time out monitoring. The other two may be 
used in any countdown application. All three issue an interrupt when the countdown 
reaches zero. 
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The I/O serial and parallel channel interfaces are shown on the following page. Four ser- 
ial channels are available as standard I/O on the AP-1. Each consists of a clock line and a 
two-way serial data bus. On the parallel channel each device has unique Service Request 
and Service Acknowledge lines. Four pairs of these lines are built into the parallel chan- 
nel. In addition, the I/O implementation induces an interchannel interface tnat interacts 
with the data out and/or data in bus of another AP-1 or SP-1 computer. 



Discrete I/O 


AP-1 Computer 


Data Out Bus 

Optional 

Zero Count 


Branch Out 


Command Out 


Data Acknowledge 


1-MHz Clock 


Data In Bus 


Input 


Direct Memory Access 


External Interrupt 


* 

Parallel Channel 

Data Request 

Lockout 


System Reset ' 


Service Request 
Service Acknowledge 




Interchannel Bus Out 

Interchannei Controls 
Interchannel Bus In 


Channel- 

to-Channel 

Interface 


Figure 4.18.3-4 


I/O Interface 
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Options 

Nine major options are available for extending the capability of the AP-1 to meet specific 
application requirements. These options are summarized below: 

1) Expanded Main Storage — The minimum configuration AP-1 has a 16-K halfword 
main storage. This may be expanded in 16-K increments to 48 K halfwords by 
inserting pairs of main storage pages (plus replacing the timing page with a new 
timing page for a 48-K storage). This modification is field installable. 



2) 64-K Main Storage — An expansion to a 64-K halfword main storage may be 
done without any changes to the architecture and organization of the computer. 
A slightly larger structure to accommodate the additional main storage pages is 
the only other requirement in addition to that listed for a 48-K halfword main 
storage. 

3) Main Storage Extension — Additional 64-K halfword modules of external main 
storage may be attached to the AP-1 computer. A factory modification, this 
feature permits a memory extension to 256-K halfwords directly addressable by 
the CPU through storage interface logic (SIL). The interface is implemented on 
an additional SIL page pluggable module working with the external main storage 
extension packages. 

4) Parallel Channel — A high-speed parallel channel with support for four devices 
(four pairs of unique request and acknowledge lines) is available. Featuring a 
channel-to-channel interface and compatibility with other Advanced System/ 

4 Pi computers, this channel provides both general register and direct memory 
access data transfers. The parallel channel option is field installable. Details 
for the parallel channel are described in the I/O section of this document. 

5) Store Protect Feature — A store protect option, which prevents the accidental 
overwrite of protected halfwords, is available as a factory modification. The 
store protect bit is set on the selected halfwords during the memory load 
through the AGE interface. It is not program resettable, assuring maximum 
integrity of the protected data. If an attempt is made to write in a protected 
area, an interrupt will be issued and serviced by the interrupt routine. Each 
MCM-1 main storage page is populated with the necessary store protect bits. 


6) Maintenance Library Program — An optional software feature, the MLP is 
used to test and debug operational programs on the AP-1. computer. Used in 
conjunction with an external data adapter and peripheral equipment such as 
a keyboard, CRT display, and tape drives, the MLP simplifies the task of op- 
erational program checkout and maintenance. 


< 

co 


7) Floating Point — This option allows floating-pojnt operations for extended 
range applications. A factory modification, the floating-point feature pro- 
vides both long and short fraction operands. The floating-point operands 
consist of a 2's complement, signed integer exponent, and a 2's complement 
fraction. General registers 4 and 5 serve as the floating-point register first 
operand during floating-point operations. 


AP-ICI format s 

8/2$ $ 8j$o 

8 6IT evFctJsvr 
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8) Field Programming System { F PS) — The FPS is an AP-1 software option that 
provides for generating and testing operational software directly on the AP-1 
computer using the computer test set, paper tape reader, paper tape punch, 
and a typewriter. 

9) Compiler — A compiler may be provided to extend the AP-1 language trans- 
lation facilities to include a higher order language (HOL) such as JOVIAL. Focr/w/v Hal , btc. 

Translation of the HOL by the compiler to AP-1 macro assembler language 

simplifies implementation of this option. 


Floating-Point Arithmetic (Optional) 

9 

* » 

Floating-point data occupy a fixed-length format, which may. be either a fullword short 


format or a three-halfword long format 

Short Operand 
• 

, 



- 

AP-lol 

S 

_MI! 

EXPONENT 

1 1 1 1 1 1 II 1 1 

7 

FRACTION 

i II 1 1 1 1 

1 1 1 

1 1 1 

8/2 f 

0 

1 

15 

16 



31 



Long .Operand 



. 




El 

I I 1 1 

EXPONENT 

1 I 1 1 1 M 1 1 1 

| 

FRACTION 

1 1 II 1 II 

35 

1 II 1 

6/ao 

0 

1 

15 

16 



47 



Note: The sign of the normalized fraction is unlike the first binary fraction digit. 


The first operand is contained in a pair of general registers. General register 4 contains the 
exponent of the first operand in bits 0 through 15. Bits 16 through 31 are ignored. Gen- 
eral register 5 contains the fraction of the first operand. The fraction of a short floating- 
point number is contsiri^djn bits 0 through 15 of general register 5. The fraction of a 
long floating-point number is contained in bits 0 through 31 of general register 5. 

Short Operand 



0 15 16 31 0 15 16 31 


Long Operand 



0 15 16 31 0 31 
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The floating-point second operand may start at any halfword address. The figure below 
illustrates floating-point data placement in main storage. 



LONG OPERAND 



Floating-Point Data Placement in Main Storage 
Floating-Point Exceptions 

The operand incompatibility interrupt, exponent overflow interrupt, and the floating- 
point divide interrupt are the three floating-point exceptions. A bit in the program status 

word (PSW) may be used to mask and hold these pending until the P,SW bit is reset to zero. 
The exception is then honored by a PSW swap. The interrupt code in the "old" PSW ident- 
ifies the particular exceptiQn. 

The instruction formats are: 

Short Format 

OPCODE OPX DISP B2 OP and OPX Ooeration code and ODeratiort code extension 


0, 4 5 7 8 

Long Format 


13 14 15 


OP and OPX Operation code and operation code extension 
R General register designation 

DISP Displacement field 

B Base register designation 

bb Addressing mode 


ADDRESS SPECIFICATION 
f I I f I I I I I I f I I I I 
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These formats are identical in form and addressing modules to the SRS and LRX instruc- 
tion formats. 


Floating-Point Features 


Instruction Length 


Repertoire 


Average Execution Times 


Exponent: 16 bits 
Fraction: Short 16 bits 
Long 32 bits 


Ap-IOI 

$ e»r^ - Hex 
24 6'T£ 

40 e*Ts 


Range: 1 0-9864 to 10+ 9864 (approx) 

Short: 16 bits 
Long: 32 bits 

Add; Add Long 
Subtract; Subtract Long 
Multiply; Multiply Long 
Divide; Divide Long 
Load; Load Long 
Store; Store Long 
Convert to Floating Point 
Convert to Fixed Point 


Add 4.00 ps 

Multiply . 9.50 ms 
Divide 13.50 ps 


AP-101 
2. GyiiSec. 


.Field Programming System (Optional) 

: The AP-1 FPS provides the programmer witft the facilities to 

1) Generate and edit source input tapes 

2) Assemble the source program modules from the generated tapes 

3) Link the program modules into an executable program 

4) Control program checkout through entry and display of data during program 

■ : execution 


The AP-1 FPS consists of the following program components: 

1) Tape Generation and Edit (TGE) program 

2) Assembler 


3) Linkage editor ..... 

4) Program verification package. 

The TGE module gives the problem programmer a tool for placing the source program 
module on punched tape, modifying that tape module before assembly, and listing the 
contents of the source tape. 
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The FPS assembler provides programmers with a convenient means of writing operational 
programs to be run on the AP-1 computer. The assembler accepts as input a symbolic 
source program module written in the assembler language, and produces as output an ob- 
ject program module. The module is ready for subsequent processing by the FPS linkage 
editor. The assembler language is upward compatible with AP-1 macro assembler, which 
operates on the IBM System/360. Programs written in the FPS assembler language may 
be assembled on either the System/360 or the AP-1. 

The FPS linkage editor, like the System/360 AP-1 linkage editor, accepts as input inde- 
• •; pendently produced object modules generated by the assembler. The linkage editor links 
these modules together into a single AP-1 executable program. 

I j . - . . ’ ' 

; The program verification package (PVP) helps the user check out his program by providing 
1 dynamic control over the program while it is being executed on the AP-1. The user may 
control program debug by entering commands to the PVP directly through the typewriter 
or indirectly through a user-written test information program. 

Compiler (Optional) 

» 

A compiler can be provided to extend the AP-1 language translation facilities to include 
a higher order language. The complier translates programs written in HOL JOVIAL to 
the AP-1 macro-assembler language. * 

The selective use of a HOL for military computer applications has been demonstrated to 
be cost- and schedule-effective. In addition, HOL programming addresses the military 
need for software commonality and maintainability. 

With the compiler, the AP-1 application programmer has at his disposal three languages 
to express his problem: 

1) JOVIAL 

: " ' 

2) Macro 

I 3) Assembler. 

I ■ ••’.-•* * 

! . ■ . . • 

. i To augment this capability, the subroutine library may be called by any one of the above 
languages. The programmer may intermix the use of these languages in any combination 
to achieve an optimum program for the AP-1 application. 


i For example, the HOL is well suited for the major and primary mission tasks. The macro 

1 language is ideal for defining unique application functions, including input/output, and the 
I assembler language best handles time-critical and bit-handling operations. 
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The AP-1 Support Programming System (SPS) provides the application programmer with 
! . a flexible set of aids designed to effectively reduce the time required to develop applica- 
| tion programs to support program modification and maintenance. Continuing a field-proven 
’ concept, the AP-1 SPS, operating on System/360 under OS control, gives the user an assem- 
! bier, a linkage editor, a simulator, a subroutine library, and an optional compiler. The pro- 
1 gram generation process is shown in the following illustration. An optional Field Program- 
i ming System (FPS) permits generating and testing programs directly on the AP-1 computer. 



AP- 1 Support Software Program Generation Process 

Macro-Assembler 

The AP-1 assembler provides the programmer with a symbolic source language that pro- 
duces storage-efficient, high-throughput programs using the effective instruction set de- 
fined by the computer's architecture. An excellent macro capability combined with math- 
ematical subroutines significantly reduces the repetitive coding required of the applica- 
tion programmer. 

Identical in most respects to the widespread, well-known System/360 assembler lan- 
! guage, the AP-1 assembler requires minimum retraining of experienced programmers and 
; provides early on-line release of new trainees, thus significantly reducing training costs. 

High-quality user and programmer manuals assist the programmers in the effective use of 
j the AP-1 assembler language. Programming rules and techniques, such as modular program- 
ming (C-sects, D-sects, etc.), syntax, macro generation, symbols and labels, source instruc- 
tions, comments and combinations, and subroutine linkage, are in most cases identical to 
System/360 operations. 


I 

i 


< 


» - • 
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Linkage Editor 

The AP-1 linkage editor accepts as input independently produced object modules gener- 
ated by the AP-1 assembler. The linkage editor combines and relocates these modules, re- 
solves module linkages, and generates an executable load module suitable for AP-1 execu- 
tion or simulation. This load module is available on paper and magnetic tapes for loading 
the AP-1 memory. Corrections can be made to the object modules at linkage edit time. 

The AP-1 linkage editor also produces a symbolic listing of the relocated load module com- 
plete with operation mnemonics, labels, and absolute addresses. 


1 Simulator 

i • 

The AP-1 simulator dynamically analyzes the executable load module produced by the 
I AP-1 linkage editor for programming errors and unusual conditions. The user has com- 
plete control of portions of code to be simulated and of stopping conditions. In addition, 

1 the user can choose several types of debug outputs, including full or partial dumps; 
instruction-by-instruction traces, complete with location symbols; and location snaps. He 
may, if he desires, devise his own format for simulation control inputs through entries 
that are available to attach simulated i/O devices. 

The AP-1 simulator program consists of a series of subroutines. To form an executable sim- 
ulation capability, these subroutines are combined with a user-written control program. 
This control program reads the control input and passes. control information to the simu- 
lator through subroutine calls. 

Subroutine calls are made through a screening interface, which detects syntax errors, if 
any, in the call; then passes information to the appropriate subroutine. 

The actual simulation is done interpretatively, with an execute table of interpretative in- 
structions being built and changed dynamically during simulation. Corrections to the load 
module to be simulated can be made at any time during the simulation. 

Functional Subroutine Library 

. The AP-1 functional subroutines consist of the elementary trigonometric, vector, and con- 
version routines. The linkage editor selectively includes these-in AP-1 application programs 
' as needed. 
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AP-1 Support Software 


Assembler 


Linkage Editor 


Efficient symbolic language *. 

Modular programming and testing 
Assembles relocatable programs 

Selects instruction length for the AP-1 machine instructions 
Provides syntax error detection and identification 
Allows macro-processing and conditional assembly 
Produces listed output 

Combines and relocates program modules assembled at separate 
times . 

Resolves program linkages 
Creates input for the Simulator 

Creates core image object programs for loading the AP-1 Com- 
puter 


Simulator 


AP-1 program analysis 

Dynamic simulation facilitated through a user-written control 
program 

User access to simulated computer object program data (with ab- 
solute and symbolic reference) 

Object program correction 

Program debugging options (dump, snap, trace) 

Provision for simulating input/output and interrupt initiation and 
response 


Subroutine Library 


Square root 
Root sum square 
Sine/cosine 
Arc tangent 
Arc sine 
Arc cosine 
Log e (X) 

Exponential e* 

Exponentiation a x 
Matrix operations 
Vector cross product 
Vector dot product 

Rectangular-to-polar coordinate conversion 
Polar-to-rectangular coordinate conversion 
BCD-to-binary conversion 
Binary-to-BCD conversion 


Maintenance Library 
Program (MLP) 
(Optional) 


Operational program debug (on the AP-1) 
Keyboard, printer, tape, CRT, I/O control 
Program load and verify 
Provides core dumps 
Memory modify 
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The SKC-2000 Computer 


A general purpose, high performance digital com- 
puter, the SKC-2000 bases its modular design 
upon a single data and cortrol bus interconnecting 
all modules with a standard interface to provide 
true modularity and maximum flexibility. Modular 
flexibility is further augmented by asynchronous 
module operation, a complete spectrum of input 
output capabilities, and contemporary mechanical 
'design utilizing 'sandwich construction which is 
easily expandable. 

SKC-2000 modules’ strict compliance with asyn- 
chronous modularity concepts permits module 


mixing or matching, and growth by adding mod- 
ules or through replacement with modules using 
newer technologies. 

SKC-2000 modules can be used, for example, to 
form a simplex central computer, a multi-computer, 
or a multi-processor installation with equal ease. 
Modules for a simplex computer typically include 
a 'central processor module, one or more memory 
modules, a power supply module, and an input/ 
output module. Because individual modules are 
relatively smaii, they are packaged most efficiently 
as part of the larger SKC-2000 computer. 


Simplex 

Computer, 


Control/Data Bus 



o 

•f-i 
(O 


Srmplex 

Computer 



Data/Contiol Bus 


I CPM 


< Simplex Computer 
with Two Memory 
Modules 


Simplex 

Computer 


Multi- Computer 
Configuration 


Executive Bus 


V 

Bus 

Extension 


Multi -Processor 
Configuration 
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Inter-module communication is accomplished via 
a bus consisting of 32 data lines, 17 memory 
address lines, 6 processor/device code lines, and 
several control lines. This bus, the bus priority 
analyzer, and asynchronous module operation 


allows direct memory access by processors or 
peripheral devices. It also permits processor-to- 
processor communication on a priority basis with 
minimum loss of time which would otherwise be 
wasted to provide synchronization. 


Memory Bite Signal 


A : 

\2_ 


32 Bit “Data Bus' 


TV 


ilnitiate 


Process or "CQcfe ‘ 6" 'Bit Device~Ub(le 

mr~ ~m 


t 


Memory V-Paiss. 

System ; initiate pulse 

I4K/8K x 


j 'Disable 

*1 MEMORY PRIORITY 




MA : 


MEMORY BUSY (5) 

.Jr ■« 


/'a 


r 


ACKNOWLEDGE 


analyzer 

(MPA) 


Data Clear 


MT 


CENTRAL 
PROCESSING 
UNIT ( S ) 
(CPU) 


' PROGRAM INTERRUPTS . INPUT-OUTPUT 
UNIT INCLUDING 
BITE 


i / • 

i / SYSTEI 


INPUT! 


e discrete inputs; 


Mode Line 


V-. 


TfT 


REOUEST ACCEPTED 




DATA AVAILABLE 


I/O COMMAND LINES-.,: 

j *'"1 


.SYSTEM 




JT 


i ; j 


7— — , t 1 > 


RELEASE DATA/ADDRESS BUS^J ! 


! 


I i 
I ; 


L 


I I 


-Memory 'Request Lines and Mode Control Lin e s 

i I I 


1.7 ,B lt A ddress Bu s' ~T7 Bit Ad dres s B us 


J L 


..j 


SK^-2000 Basic Computer Bus Interconnection 


SKC-2000 computer through-put is outstanding, 
and varies with the choice of memory module. 
A simplex computer performs 320,000 add type 
operations per second using the 1.9 ^sec memory 
module, 470,000 operations per second with the 
LSI scratch pad and 530,000 operations per second 
when a solid state ROM and an LSI scratch pad 
memory is employed. Multi-computer and multi- 
processor configurations typically provide more 
than 1,000,000 operations per second with core 
■ memories. High density packaging gives the SKC- 
2000 computer outstanding through-put-to-volume 
and through-put-to-weight indices. 


CENTRAL PROCESSOR MODULE 


Parallel organization and floating point arithmetic 
in the centra! processor module provide outstand- 
ing arithmetic capabilities. The processor operates 
upoh 32 bit operands and has double precision 
add and subtract instructions for those computa- 
tions requiring exceptionally high accuracy. Simul- 
taneous indexing capability on two levels facili- 
tates matrix operations, and the 88 index registers 
located in memory assure sufficient capacity for 
large computation loads. 
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Type 

Military Specifications 


! • rrv 


General purpose, parallel, asynchronous module, high speed data/control bus 
MIL-E-5400 Class 2, MIL-E-16400 


Number Systems 

Data Words, Floating Point 

Data Words, Fixed Point 

Instruction Words 

Instructions 

Address Modes 

Indexing 1st Level Registers 

Indexing 2nd Level Registers 

Execution Times, 'Average for: 

Add Fixed Point, Msec 
Multiply Fixed Point, Msec 
Divide Fixed Point, Msec 
Add Floating Point, /usee 
Multiply Floating Point, Msec 
Divide Floating Point, m sec 
A Time Indexing, /xsec 
Normalization Time (NT) 
Memory Words Directly Addressable 
Electronic Technology 
Power 
Voltage 
Weight 
Options 


PARALLEL CENTRAL PROCESSOR MODULES 


Binary, floating point and two’s complement fixed point 

24 bit mantissa, 8 bit exponents 

32 bits including sign 

16 bits short and 32 bits long 

99 total long and short 

direct, indirect, relative, immediate 

15 | 4 groups for a total of 88 

1.9 p.sec'Memory T.9 /isec'Memory with LSI 

3.125 2.125 

6.625 5.875 

10.75 . 10.0 

4.0 4- NT 3.25 -f NT 

7.0 6.25 

9.5 8.75 

2.0 1.0 
.25 yxsec/shift 
131,072 
MSI/m 
75 Watts 
+5 volts ±5% 

3 pounds including structure 
Fast shift matrix, Vi word arithmetic 


ROM Program Store '& LSI Scratchpad 

1.875 
5.5 
9.625 

2.875 + NT 

5.875 
8.325 
1.0 


Standard Type 
Optional Types 
Module Size 
Access Time, LSI 
Access Time, 1.9 Msec Core 
Protected Program Storage 
Contents Protection 
Special Techniques 

Electronic Technology 
Power, Long Term Average 
Voltages 
Weight 


MEMORY MODULES 

20 MIL DRO lithium ferrite core, coincident current 3 wire, 3D 

Plated wire, 1.2 Msec 2‘/z D core, solid state LSI scratchpad, solid state ROM 

4K, 8K words by 32 bits 

0.25 Msec 

<1.00 Msec 

2 AGE and/or program controlled subsets 

Over-voltage; under-voltage; over-temperature; erroneous input signals 
Selection currents controlled by single thermal sensor; strobe timing slaved to selection 
current amplitude 
MSI/TTL, Hybrid 

85 watts typical, 1.9 Msec cycle core 
±5 volts ±5%; ±12.5 volts ±2% 

6 pounds including structure 


Program Interrupts 
Direct Memory Access I/O 
Data Bus 

Data Flow, 1.9 Msec Memory 
Data Flow LSI Memory 
Programmed I/O 
Channel Device Codes 
Discretes (Input Switch Type) 


INPUT/OUTPUT CAPABILITY 

16 priority levels ~ expandable (7 preassigned including power failure, BITE, Control Console) 
16 priority levels (2 preassigned) 

32 bit parallel — 4 MHz 
500,000 words/sec 
1,000,000 words/sec 

To/From Memory; To/From CPU, command or dat3 designation, with or without acknowledge 
61 directly addressable; 14 are useable for DMA 
8 directly interrogated and branched upon 


Packaging 
Cooling 
Circuit Cards 

Baseline SKC-2000 

Size 

Power 

Weight 


PHYSICAL FEATURES 

K ATR cross section, variable length 

Forced air or cold plate 

X-Y 

Parallel CPU, 8K x 32 bits 1.9 Msec cycle memory, 3 card I/O and power post-regulators 
15.33 in. long x 7.50 in. wide x 4.88 in. high 
245 watts including regulator loss 
19.7 pounds 
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The order set of 99 was derived by detailed con- 
sideration of aerospace computer programming 
requirements and is a balanced set providing an 
optimum combination for computation and pro- 
gramming ease. Inclusion of many big-machine 
features facilitates transition to the SKC-2000 by 
the programmer who is familiar with large com- 
mercial computers. 

Instructions having short and long formats, 16 and 
32 bits respectively, enhance efficient memory 
usage. Experience shows that 80% to 90% of the 
instructions will be in short format form. Typically, 
.instr.uctions,,use j the ..-greater. ...part ..of ...memory. 
Hence, packing two instructions per memory word 
results either in appreciable reduction in memory 
size or a greatly increased number of instructions 


for a given memory size. An 8192-word memory 
module provides approximately 10,000 instructions 
and 2,000 words of scratch pad, making it the 
equivalent of a 12,000-word memory. 


Addressing modes include: (1) direct, for operand 
location at the address specified by the instruc- 
tion; (2) indirect, for operand location at the 
address specified, at the address specified by the 
instruction (up to 16 levels); (3) relative, for 
operand location at the effective instruction ad- 
dress plus first and second level index registers; 
-and «(4) -immediate, .for .operand location in the 
address portion of the instruction. Relative ad- 
dressing may be combined with either direct or 
indirect addressing. 


MEMORY MODULES - 

Designed as independent, asynchronous modules 
of 4K or 8K words by 32 bits, standard ferrite core 
memory modules have 1.9 microseconds cycle 
time. Asynchronous modules operate independent- 
ly of the 4 MHz computer clock and use an initiate 


pulse from the requesting processor or device to 
start the memory cycle and issue a “data avail- 
able” signal at the cycle’s completion. Thus, asyn- 
chronous operation allows use of any memory 
cycle time while maintaining full compatibility with 
other modules. 
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Optional memory modules include LSI read only, 
LSI read/write, plated wire, and 1.2 ^sec 2V2 D 
core.^ 

Standard core'memories use MSI, TTL, and hybrid 
circuits to provide high reliability and small size. 
A novel circuit using a single precision alloy re- 
sistor mounted on the core stack to sense temper- 
ature and to control X and Y currents for both read 
and write, precisely slaves read and write currents 
to each other. 

Another unique circuit slaves strobe timing to 
selection current amplitude and rise time, assuring 
interrogation at the output signal’s optimum point. 

Memory modules provide program storage protec- 
tion against inadvertent write cycles, the protected 
portion being adjustable by program control or 
during manufacture to fit system requirements. 
Another design feature is the inclusion of memory 
address latches within each module. 


I/O module and provide direct communication 
with external units. I/O capabilities of the com- 
puter include: 

1. Data Transfer 

a) Program Controlled; “A” Register, Memory 

b) Direct Memory Access 

2. Priority Interrupts 

3. Discretes (switches) 

Program-controlled I/O utilizes programmed in- 
structions to transfer information to and from the 
'computer “A”*registeror to.and from the computer 
memory. These instructions may request an ack- 
nowledgement and may designate the information 
being transmitted either as data or as a command. 
All combinations of input/output, acknowledge- 
ment, and data/command give 16 types of pro- 
gram-controlled transfers for each of 61 directly 
addressable devices. Program-controlled I/O in- 
structions are long or short instruction formats for 
global and non-global addressing with indirect 
addressing applicable to global addressing. 


Protection against over-voltage, under-voltage, 
over-temperature and erroneous input signals is 
built into the memory module. Resulting signals 
force the computer into a shut-down routine and 
are transmitted to the system’s built-in test equip- 
ment (BITE). 


INPUT/OUTPUT MODULE 

Extensive input/output capabilities of the SKC- 
2000 facilitate design of an application-oriented 


Direct memory access (DMA) by other computers 
or devices allows high speed data transfer to and 
from SKC-2000 memory modules independent of 
central processor module operation. Access to the 
memory is accomplished via the bus system allo- 
cated to various users on a priority basis. Use of 
DMA facilities permits an external device to insert 
or extract words almost arbitrarily from the com- 
puter memory, bypassing all program control logic. 
DMA transfer is particularly well suited to devices 
transferring large amounts of data in block form 
such as tapes, drums and disks, for information 
exchange between computers, or for sensors gen- 
erating or requiring large amounts of data. 


i 


i 



< 


Program interrupts are signals having preassigned 
priority which divert the program to assigned loca- 
tions in memory. Jump commands in each of these 
" locations direct the computer to the interrupt sub- 
program. The program counter vaiue at the time 
of the interrupt is stored for use when returning to 
the main program. Of the 16 interrupts provided, 
in the basic computer, 7 are preassigned, leaving 


I , : ; : ■ I 

9 for other system uses. Unlimited interrupt ex- 
pandability may be provided in the input/output 
section. j 

8 discrete (switch) inputs which are directly ac- ; 
cessible to the program via the “Jump on Switch i” 
order are accepted by the SKC-2000. Additional j 
discretes may be handled by conventionally pro- ! 
grammed I/O techniques. j 
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SKC-eOOO COMPUTER — ' 
COMPUTER BUS 
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DIGITAL I/O OCVICE 

J BUS 
• n SWITCHES 

... : -*rr .j ■ » 


DEVICE 
CODE B I/O 
DECODING 
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DECODING 
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oo 

CD 
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Typical I/O channel capabilities include serial 
channels with I/O bit rates up to 4 megabits/ 
second. Channel control can be by direct program 
control, by an I/O processor operating indepen- 
dent of the program, or by an I/O processor which 
operates independently but is directed by software. 
Similarly, parallel channels operating at up to 16 
megabits per second are available. 

A block transfer channel for communication with 
standard peripherals in byte format is also avail- 
able. This channel is started under program control 
tjy .setting. a. register with. the .starting. .address. .and 
number of words to be transferred. The transfer is 
then automatically controlled by the block transfer 
channel which stops when the correct number of 
words have been transferred. 


speed computers. Self-checking capabilities as- 
sure operational precision. 

BITE SUBMODULE 

A comprehensive combination of software and 
hardware built in test equipment provides efficient 
self-test features for error detection and program 
protection and is integral to computer design. The 
BITE submodule is located in the I/O module. 

In operation, the combination — 

-a ^determines.computer. performance 

■ protects hardware from damage 

■ protects memory against information loss 

■ isolates faults for maintenance 

and traceability 

■ processes and traces errors 


Analog to digital and digital to analog converters 
built into the SKC-2000 digital computer’s input/ 
output module are compact, high accuracy, high 
reliability circuit board-mounted units demonstrat- 
ing high-speed conversion compatible with high 


Software is provided to check program storage 
(memory sum), check the computer’s central pro- 
cessor, end around check the I/O channels etc., 
and to process the BITE priority interrupt. 


BITE priority interrupt is based on the following signals: 


SIGNAL 

Memory Power Fail 
BITE Memory One 
Memory Over-Temperature 
Bus Priority Time Out 
Indirect Addressing Fail 
Time-Out Alarm 
T, Time-Out Alarm 
Master Clock Pulse Fail 
Primary Power Fail Interrupt 
4 Spare Signals 


FUNCTION 

Out-of-specification memory input power levels detected 

Protected storage alteration attempted by program 

Memory temperature exceeds specified value 

User failed to generate memory release signals 

Indirect addressing exceeded 16 levels 

Time-out counter improperly reset by CPM 

CPM reset time exceeded time allotted 

Master clock failure detected 

120 fisec warning signal to CPM 

Available per application requirements 



< 

CO 


POWER SUPPLY MODULE 

Power supply modules for the computer system 
vary depending upon the type of memory modules 
chosen and input/output module design. The 
power supply typically operates from 115 volts 
400 Hz or from 28 volts DC prime power. Each 
power supply module is equipped with a high 
efficiency switching regulator designed in accord- 
ance with MIL-STD-704A, and has over-voltage, 
over-load, and short circuit protection. In addition 
to providing line conditioning and RFI attenuation, 
continuous fault monitoring (BITE) operates to 
assure orderly shutdown in the event of out-of- 
tolerance conditions. Internal energy storage is 
sufficient to complete the current instruction and 
store the contents of status and CPU registers. This 


orderly shutdown is followed by deactivation of the 
memory circuits. 


PACKAGING 

SKC-2000 packaging employs a stacked and 
clamped card mounting technique in which the 
cards form an integral "box-like” structure for the 
overall assembly. Four iongitudinal members 
(straps) are used to clamp the cards between a 
front connector panel and rear support panel. 
Lower straps form a subchassis by providing the 
structure for retaining the female connector plate 
motherboard assemblies and for card keying and 
guiding. Card removal is effected by loosening 
four front bolts and lifting the two upper straps. 








398 - 8 - 


DATE 10-20-72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

0 

PAGE 

no. ^ ”288 

REV. 

BINGHAMTON. NEW YORK ' 

REP. 

NO. 



Designed to be hard-mounted to eliminate the 
need for vibration isolators, the computer has been 
subjected to extensive vibration tests without any 
failures. A thorough dynamic analysis shows that 
all stress levels are well below fatigue limits. 

SKC-2000 computers are designed to be easily 
maintained, having conveniently located and read- 
ily accessible test points which contribute to a 
short mean time to repair. The design includes 
separate external AGE and test connectors and 
accessible test points on individual cards. 


Circuit card construction used throughout incorpo- 
rates several unique features which provide effi- 
cient methods of flatpack interconnection and heat 
removal while reducing electromagnetic interfer- 
ence. A glass-filled epoxy double-sided laminate 
0.008 inch thick provides electrical insulation and 
serves as a base for the conductors. These are 
routed in the X direction on the outer surface and 
the Y direction on the inner surface. Interconnec- 
tion between X and Y conductors is accomplished 
by plated-through holes, a type of construction 
which achieves a significant increase in reliability 
and producibility over multilayer boards. 




SKC-2000 COMPUTER 
PROGRAMMING AND SOFTWARE 


The SKC-2000 computqrjs significantly easier to 
; program than previous military computers. Fea- 
tures that facilitate programming are: 

n Floating point arithmetic eliminates scaling 
B 88 index registers eliminate memory 
boundaries 

b Dual level index registers simplify reentrant 
subroutines 

a Incremental addressing in branch instruc- 
tions for relocatable subroutines 
B Trap instructions provide for special 
instructions 

B Large instruction repertoire for minimizing 
computation time 

In addition to hardware designed for the pro- 
grammer, a powerful software package is avail- 
able to complement machine language program- 
ming. It includes an assembler, a loader, an 
arithmetic simulator, an interpretive simulator, 
utility routines, and diagnostic routines. 


The assembler/loader is designed to allow the 
user great flexibility and utility in his coding. Fea- 
tures include relocatability, reentrancy, addressing 
via index register modification, availability of com- 
mon (blank or labelled) and globally defined sym- 
bols. An assembly language, FOCAP, has been 
developed and documented for the assembler/ 
loader. 

SKC-2000 simulators operate on a host machine 
via the host machine’s assembler. They simulate 
execution of a user program written for the SKC- 
2000 as if the user program were actually running 
on the SKC-2000. The arithmetic simulator repro- 
duces the arithmetic of the SKC-2000 in the man- 
ner most expeditious in the host machine. An inter- 
pretive simulator accepts the binary pattern used 
in the SKC-2000 and interprets each instruction, 
performing each operation exactly as in the SKC- 
. 2000. The arithmetic simulator runs much faster 
and is useful for much of the program checkout. 
The interpretive simulator is a very desirable tool 
where real-time and I/O problems do not lend 
themselves to hands-on debugging. 
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4 5 6 8 9 


15 



IBHN 

1 1 1 

M7 
1 1 j_ 

i l_ 

• 


15 6 8 9 

12 13 

14 15 16 


31 





OP 

PRIMARY OPERATION CODE (5 BITS) 





LONG/SHORT OPTION 

BIT 5 IS 0 FOR SHORT 






BIT 5 IS 1 FOR LONG 





X, 

1ST LEVEL INDEX REGISTER SELECTION 




* 

x, 

2ND LEVEL INDEX REGISTER SELECTION 





IM 

IMMEDIATE ADDRESSING 





1 

INDIRECT ADDRESSING 



• * 


T 

TRAP BIT 





M7, M16 

MEMORY ADDRESS FIELD 





E 

EFFECTIVE ADDRESS = M + DC,) + (X 2 ) 




MNEMONIC 



EXECUTION TIME (mSEC) 

INSTRUCTION 

SHORT FORMAT 

LONG FORMAT 


CORE 

LSI 

CORE 

LSI 

LOAD THE A REGISTER 

3.125 

1.625 

4.0 

2.25 

LOAO THE B REGISTER 

3.125 

1.625 

4.0 

2.25 

LOAD THE X REGISTER 

3.125 

1.625 

4.0 

2.25 

ADD UPPER FIX POINT 

3.125 

1.625 

4.0 

2.25 

ADD LOWER FIX POINT 

3.125 

1.625 

4.0 

2.25 

SUBTRACT UPPER FIX POINT 

3.125 

1.625 

4.0 

2.25 

SUBTRACT LOWER FIX POINT 

3.125 

1.625 

4.0 

2.25 

ADO FLOATING POINT 

3.5 + SC* 

2.75 

4.125 + SC* 

3.50 

SUBTRACT FLOATING POINT 

3.5 + SC* 

2.75 

4.125 + SC* 

3.50 

MULTIPLY FIX POINT 

6.75 

5.325 

7.5 

6.25 

DIVIDE FIX POINT 

10.75 

9.5 

11.5 

10.25 

MULTIPLY FLOATING POINT 

7.0 

5.75 

7.75 

6.50 

DIVIDE FLOATING POINT 

9.5 

8.25 

10.25 

9.00 

SKIP ON A REGISTER MASKED 

3.5 

2.5 

1.25 

3.00 

LOGICAL OR 

3.125 

1.625 

4.0 

2.25 

LOGICAL AND 

3.125 

1.625 

' 4.0 

2.25 

EXCLUSIVE OR 

3.125 

1.625 

4.0 

2.25 

STORE THE A REGISTER 

3.125 

1.625 

4.0 

2.25 

STORE THE B REGISTER 

3.125 

1.625 

4.0 

2.25 

STORE THE X REGISTER 

3.125 

1.625 

4.0 

225 

RETURN ADDRESS 
(UNCONDITIONAL JUMP) 

3.5 

2.25 

4.125 

3.00 

ADD DOUBLE PRECISION 
FLOATING POINT 
SUBTRACT DOUBLE PRECISION 

3.75 + SC* 

3.25 

4.375 + SC* 

3.75 

FLOATING POINT 

3.75 -f SC* 

3.25 

4.375 -f SC* 

3.75 

LOAD THE A REGISTER WITH E 

1.625 


2.25 


LOAD STATUS REGISTER 



4.0 

2.25 

STORE STATUS REGISTER 



4.0 

2.25 

LOAD INTERRUPT REGISTER 



4.0 

2.25 

STORE INTERRUPT REGISTER 



4.0 

225 


TIMES ARE BASED UPON 1.9 m SEC CORE AND LSI MEMORY. 


'NORMALIZATION TIME 0.25 M SEC/SHIFT 
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02 AND 04 SECONDARY OPERATIONS CODES 
-S . NUMBER OF. PLACES TO. BE SHIFTED 

S = (X,) + N 



INSTRUCTION 

EXECUTION TIME (^SEC) 
SHORT FORMAT 

SRA 

SHIFT A RIGHT ALGEGRAICALLY 

1.75 + N/4 

SLA 

SHIFT A LEFT LOGICALLY 

WHERE N IS 

SRL 

SHIFT A, B RIGHT ALGEBRAICALLY 

THE NUMBER 

SLL 

SHIFT A, B LEFT LOGICALLY 

OF BITS 

SRC 

SHIFT A RIGHT CIRCULARLY 

SHIFTED 

SCR 

SHIFT A, B RIGHT CIRCULARLY 


SCL 

SHIFT A, B LEFT CIRCULARLY 


SRG 

SHIFT A, B RIGHT LOGICALLY 






INDEX-REGISTER COMPARE AND INCREMENT INSTRUCTIONS 

1 O 45689 12 13 14 15 16 31 


1 

I 

H 

HI 

0 

1M 

fl 

h MM 


■ 





■ 





T TEST CRITERION/ADD-SUBTRACT 

E EFFECTIVE ADDRESS = M16 OR IM16) 



• 7, . " ... 

EXECUTION TIME (/xSEC) 

MNEMONIC 

. INSTRUCTION 

LONG FORMAT 



CORE 

LSI 

ICN 

TEST SELECTED INDEX-REGISTER 
FOR NOT-EQUAL, AND SKIP 

4.00 

2.75 

ICL 

TEST SELECTED INDEX-REGISTER 
FOR LESS-1HAN, AND SKIP 

4.00 

2.75 

IMP 

MODIFY INDEX-REGISTER BY 
POSITIVE INCREMENT 

4.00 

2.75 

IMN 

MODIFY INDEX-REGISTER BY 
NEGATIVE INCREMENT 

4.00 r 

2.75 _ 



a. 


























-398 


DATE 10-20-72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE NO. 4-291 

REV. 

8 INGHAMTGN . NEW YORK 

. 

REP. NO. 



5 6 8 9 





-C 

JUMP.CRITERIA 


BIT 5 

0 = SHORT; 1 = LONG 

i. 

P 

ADO OR SUBTRACT 


MNEMONIC 




EXECUTION TIME (/xSEC) 

INSTRUCTION 

SHORT FORMAT 

LONG FORMAT 


CORE 

LSI 

JUMP REUTIVE UNCONDITIONAL 

1.63 



JUMP RELATIVE IF CIA) < 0 

1.63 



JUMP REUTIVE IF CIA) > 0 

1.63 



JUMP REUTIVE IF CIA) = 0 
JUMP ON PROGRAM FUG 

1.63 

2.25 


JUMP IF CIA) < 0 


2.25 


JUMP IF CIA) > 0 


2.25 


JUMP IF CIA) = 0 


2.25 


JUMP ON SWITCH i 


2.25 


JUMP ON STATUS BIT i 


2.25 


JUMP UNCONDITIONALLY 


2.25 


JUMP UNCONDITIONALLY 


6.00 

4.25 

TO SUBROUTINE 
JUMP THROUGH TRAP 
INTERRUPT (4 AVAIUBLD 


6.00 



NON-MEMORY REFERENCE INSTRUCTIONS (Short Instruction) 

O 4 5 6 7 8 9 II 12 15 




SECONDARY OPERATION CODES 

PROGRAM FUGS/ INTERRUPT CONTROL SELECTION 



MNEMONIC 

INSTRUCTION 

NOP 

NO OPERATION 

HLT 

HALT 

SET 

SET SELECTED PROGRAM FUGS . 

RST 

RESET SELECTED PROGRAM FUGS 

EPI 

ENABLE PROGRAM INTERRUPTS 

DPI 

DISABLE PROGRAM INTERRUPTS 

DMI 

DISADLE MEMORY INTERRUPTS 

EMI 

ENABLE MEMORY INTERRUPTS 

CFX 

_ CONVERT FLOATING POINT TO 


FIXEO POINT 

CXF 

CONVERT FIXED POINT TO 
FLOATING POINT 

EAB 

EXCHANGE A & B REGISTERS 

•NORMALIZATION 

TIME 0.25 jzSEC/SHIFT 


INSTRUCTION TIME (jiSEC) 
SHORT FORMAT 



1.63 

1.63 

1.63 

1.63 

1.63 

225 + NT* 
4.25 + NT* 





























-398- 


DATE 10 - 20-72 


REV. 


THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

B I N6HAf.1T ON . NEW YORK 


PAGE NO. 4 - 29 ? 


REP. NO. 




K ACKNOWLEDGE 




< 

CO 


MNEMONIC 

INSTRUCTIONS 

INSTRUCTION TIME ( M SEC) 

SHORT FORMAT 

LONG FORMAT 

CIM 

CONDITION. I/O TO MEMORY 


4** 

DIM 

DATA, I/O TO MEMORY 


4** 

CIP 

CONDITION, I/O TO CPU (A REG) 

2.38 AVG. 


DIP 

DATA, I/O TO CPU (A REG) 

2.38 AVG. 


COM 

condition; memory to i/o 


4** 

DOM 

DATA MEMORY TO I/O 


4** 

COP 

CONDITION, CPU (A REG) TO I/O 

2.38 AVG. 


DOP 

DATA, CPU (A REG) TO I/O 

2.38 AVG. 



**PLUS ACKNOWLEDGE DELAY 


NOTES: 1. Times are average, based upon use of the 2.0 ,xS memory initiation 
pulse and include memory access. Individual times vary dependent on 
machine operational state. 

2. Reductions in execution times are available through memory overlap 
operation. 

3. Each indirect operation adds one memory cycle time to the execution 
time. 

4. One level indexing does not increase execution time. Two levels add 
0.5 ftsec. 
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4.18.4 Orbiter GN.'C Opera t. Iona 1 Flight Computer Program 

The- operational flight program for the Shuttle on-board GN&C 
computer consists of an executive and a set of "mission" modules (see 
Figure 4.18.4-1 which can be assembled to build up an operational pro- 
gram to accommodate all Shuttle baseline missions. The computer program 
for the GN&C computer will be devoted to the solution, display and 
performance monitoring of the Guidance, Navigation and Control problems 
of the Shuttle Orbiter. Peripheral support such as displays and per- 
formance monitoring of non-GN&C orbitc-r subsystems will be provided by 
dedicated MDE processors which. are divorced from the GN&C processors. 

The GN&C Operational Flight computer program description covers 
the operational software functions for the orbiter from prelaunch 
through landing. The GN&C software functions include Guidance, Naviga- 
tion, Control, Attitude reference, Executive, and in conjunction with 
the MDE computer, Display Processing and status monitoring. The defined 
functions within the above functions for all mission phases are: 



< 


. Guidance 

Prelaunch Targeting 

Atmospheric guidance during boosts 

Orbit injection guidance 

Prethrust targeting for rendezvous and deorbit 
Cross-product steering 
Entry guidance 

Approach guidance ., 
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Navigation 
Pre launch alignment 
Powered and unpowered navigation 
Earth relative navigation 
On-orbit updating (horizon sensor) 

Target navigation 
Entry navigation 

Atmospheric navigation (TACAN Updating) 

. Attitude Reference 

Direction cosine and Euler angle computation 
Platform updates (Star Tracker) 

Gyro compassing during prelaunch 
. Flight Control 

Main engine thrust vector control 
ACPS control 
Thrust on-off control 
Entry program control 
. Executive 

Task control 
I/O control 
Common routines 


Tables 
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Display Processing 
Display I/O . 

Tables 

... -,S.t.atus .Hon.ltQring 

‘ Maintain system status 
Computer self test 
Command/response tests 
Limit checks 
Reasonableness tests 

In addition, the software functions include sequencing and 
interfacing with the MDE computer and systems other than GN&C 

The overall control of the operational program is provided by 
the executive sub-program. The Executive sub-program provides for the 
flow of information between programs and the external environment and 
provides for standardization of interfaces in the presence of a variety 
of modules and for management of the program resources to assure the 
response required by the system. In addition,,, the executive program wil 
provide an internal environment which will permit application programs 
to be constructed and executed independently of one another and allow 
a modular program structure which emphasizes operational flexibility, 
ease of modification, and capability for growth. 
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All computer program instructions will reside in protected 
memory locations while all computer variable data will reside in un- 
protected memory locations. Protected memory is defined as read-only 
memory while unprotected memory is defined as read-write memory. The 
protected and unprotected memory locations are predetermined during the 
^program development ^process and .will .not change during a mission time 
span. All unused memory locations will be assigned as protected memory. 
If any program attempts to write into protected memory, the computer will 
enter a fail state. 

Individual program will be responsible for all internal program 
calculation scaling and arithmetic manipulations in order to attain 
sufficient accuracy as required for the Shuttle Orbiter configuration fo 
all mission phases. Extended precision arithmetic functions will be use 
as required. The fixed point scaling must be sufficient to accommodate 
the maximum expected values and maintain the required parameter reso- 
lution. 

Software Elements 

The following paragraphs describe design concepts for the on- 
board Shuttle GK&C Flight Program. 

a. On-board Executive System . This section describes the on- 
board cxecurive control system. 

1. Basic Structure . The executive structure will be based 
on a timer interrupt, fixed schedule, time slice mode of operation. In 
effect, this type of executive does not require, nor allow, instantaneous 
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response to external interrupts. 

The timer interrupt interval will be under program control 
and will provide the initialization and reference for the basic executiv 
time structure. When the executive detects a timer interrupt, it will 
process its schedule tables to determine which set of program jobs are 
t-o be -executed 'during -the -next -program interval. 

’ All program intervals will be approximately equal in execu- 
tion time. This will be accomplished by predetermining the time require 
for the longest path in each job and shuffling jobs to balance the time 
intervals. Each time interval will contain portions of various rate 
jobs as required to satisfy the time and rate constraints. 

The program intervals occur 25 times per: second, based on 
the maximum system sample rate. Each interval contains all 25 per sec- 
ond jobs, every other interval contains 25 and 12.5 per second jobs, 
every fourth interval contains 25 and 6.25 per second data, etc. 

2, Job Schedule . The Job Schedule function manages the 
sequence in which programs are executed. System considerations determine 
the priority of the routines driven by the schedule function. The job 
schedule function is designed to respond quickly to execution requests 
on a predetermined priority basis. 

All external interrupts are treated by the schedule as 
discrete inputs (ON-OFF) . The scheduler will mask the interrupt and 
sample the interrupt statue on a periodic basis. An interrupt detected 
as ON will result in the scheduler modifying its scheduled jobs or 
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setting a flag to be used by one of the sub - programs . 

Internal interrupts such as the Internal Timer or Machine 
Error interrupts will be handled as true interrupts, as follows: 

(a) Internal Timer Interrupt - This interrupt will occur 
when a pre-set timer counts down. The program will set the time to coun 

•«down in -40 -miltlAseconds (based on accepted maximum sample rate of 25 per 
second) . This interrupt will cause the program to exit its present 
scheduled job and return to the basic scheduler entry point. The pro- 
gram structure will be designed so that this interrupt will always occur 
during a low priority (background) job or during an idle state. 

(b) Machine Error Interrupt - This interrupt indicates 
that the computer circuitry has detected a problem in the computer 
hardware. This interrupt will force the program into an error detection 
self test mode. Verification of the machine error will cause the compu- 
ter to be shut down. One of the redundant computer systems will take 
over control of the orbiter vehicle by manual or automatic means. 

3. Input/Output Supervision . The input/output supervision 
function controls all the operations associated with the input/output 
buffer device. Effectively, the input /output supervisor will input 
data at interval n to be used in calculations in interval n 4* 1. The 
output data at interval n is for data calculated during interval n-1. 

For time critical functions, the input-calculation-output process will 
be optimized to satisfy the required time constraints. 
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The input and output data is normally a function of mission 
phase, sequencing, control panel selection, job scheduling, etc.; as such 
the data set is variable and is a function of the jobs schedule by the 
executive. 

The input/output data will be transmitted to or received 
from the input/output buffer utilizing predetermined unprotected main 
memory locations. " 

4. Systems Services . Systems services provides the 
function of system and applications program interface with the operator 
of the system. This function will sample all input control media such 
as control panel switch positions at a predetermined and constant rate, 
nominally 6 samples per second. If the panel switch inputs are in a 
changed state for two or more successive samples, the services facility 
will either change the job schedule to satisfy the inputs or set a flag 
for usage by the subsystems program. 

5. Systems Clocks . This facility will provide the 
capability of maintaining unique clock facilities for system usage. The 
clock facility will be utilized for display functions, sequencing, or 
subsystem usage. System clock accuracy and update rate will be consis” 
temt with accuracy constraints on the onboard system. The clock 
facilities will include Time' From Launch, GMT, Launch Local Time, Time 
to Go to Event, and Time in Mission Phase. Maximum clock update rate 
for a minimum number of: time bases will be 25 per second. Nominal 
clock update rate will be 1 per second. The basic time information for 
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calibrating the Software clocks shall be provided by the Master Timing 
Unit or the Display Keyboard. 

6. Common Subroutines . This service facility will contain 
all common subroutines to be used by the various subprograms. Included 
in the common subroutines are the standard mathematical fu notions to 
determine sine, cosine, tangent, square root, root mean square, matrix 
inversion, etc. In addition to the standard set of subroutines, this 
facility will contain other routines that are used by more than one 
subprogram. The subprograms will branch to the appropriate subroutine 
as necessary; exit from the subroutine will be to the using subprogram. 

7. Common Data Blocks . The Executive program will 
maintain common data blocks of unprotected memory. The Common Data 
Blocks will be available for usage by all programs, subprograms or 
routines. Inclusion of data in the Common Data Blocks implies that data 
is used across program interfaces. Data that is unique to individual 
programs such as scratch pad memory, constants, etc., will be maintained 
in individual local program data blocks which are not accessible to 
other programs. 

8. Self Test . The Self Test function will be executed 

on a minor cycle basis to determine and verify the operational state of 
the GN&C computer. This function will .be- designed to execute a maximum 
number of computer program instructions and to compare results of mathe- 
matical manipulations against a predetermined result. Failure of the 
Self Test function in a particular’ computer will result in a shutdown 
of that computer. 
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9. Systems Tables . The executive program structure will 
be designed to maximize the usage of System Tables in conjunction with 
simple subroutines for execution of the System Table data. The System 
Table concept simplifies the programming, checkout and validation of 
the GN&C Flight Program in addition to providing a relatively simple 


..means .of .incar-pQr.ati.ng ..program changes .and updates . 


b. Guidance. Navigation, and Control Programs . The GN&C 
software consists of the operational software functions from prelaunch 
through landing. The GN&C software functions include Guidance, Naviga- 
tion, Control, attitude reference, Executive, Display processing, and 
status monitoring. These functions are required for both the orbiter 
and the booster of the flyback (LOX/RP) configuration. 

However, a pressure fed booster which is controlled by the 
orbiter and which is towed to the launch site after a free fall return 
would not require any software functions: the orbiter GN&C computer 
would be augmented to provide the pressure fed booster control during 
the mated boost phase. 

The LOX/RP booster configuration contains its own GN&C 
computer with the same functions as the orbiter during prelaunch, 
mated boost, and separation. A period of booster coast and retunr to 
atmospheric flight requires computer Guidance, Navigation and ACPS 
control. These functions are performed by the computer until the 
pilot initiates manual control. 

Table 4.18.4-1 summarizes the orbiter GN&C program func- 
tions by mission phase. 
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Table 4.18.4-1 Orbiter Mission Phase Requirements Summary 

j : ■ < 


PHASE 


GN&C FUNCTIONS 


Prelaunch 


Mated Boost 


Separation/Orbit Insertion 


Rendezvous /Unpowc red 


/ Rndezvous /Powered 


Docking 


Targeting Update 
Powered Navigation 
Prelaunch Nav Update 
Direction Cosines Computations 
Prelaunch Gyro Compassing 

Powered Navigation 
Earth Relative Navigation 
Direction Cosines Computations 
Open Loop Guidance 
Closed Loop Guidance 
Abort Guidance , 

1 ’ 
Powered Navigation 
Earth Relative Navigation 
Separation Guidance 
Abort Guidancq 
Injection Guidance 
Separation Control 
Thrust Vector Control 
Thrust On-Off Throttle Control 
Direction Cosine Computations 
Euler to Body Transforms 

Orbital Navigation 
Direction Cosine Computations 
Update Pl.-Jtform Attitude 
Euler to Body Transform 
ACPS Control 
Thrust On-Off Control 
Rendezvous Targeting 
Prethrust Maneuver Targeting 
Targeting Conic Routines 

Powered Navigation 
Direction Cosine Computations 
Euler to Body Transform 
Thrust On-Off Control 
Cross Product Steering . . 

Unpqwcrcd / powered Navigation 
Manipulator Arms 
Target Relative Navigation 
Direction Cosine Computations 
Euler to Body Transform 
ACPS Control 
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Orbiter Mission Phase Requirements Summary (Cont. ) 


Table 4.18.4-17 

- . , -'t' 

PHASE 

. Dcorbit Maneuver Sequence 
(Unpowered) 


Deorbit Maneuver Sequence 
(Powered) y , 


Entry 


Aerodynamic 

• .w.. 


GN&C FUNCTIONS 

Unpowefed Navigation 
Earth Relative Navigation 
Direction Cosine Computations 
Euler to Body Transform 
Attitude Update 
Deorbit Targeting 
Target Conic Routines 
Prethrust Maneuver 
ACPS Control 

Powered Navigation 
Earth Relative Navigation 
Direction Cosine Computations 
Euler to Body Transform 
Thrust Vector Control 
Thrust On-Off Control 
CrosB Product^Stccring 

Powered Navigation 
Earth Relative Navigation 
Direction Cosine Computations 
Body Axis Error ComputaHono 
Attitude Control 

Approach Guidance 
Earth Relative Navigation 
Atmospheric Nav/Aids Updates 
Aero Flight Control 
Attitude Reference 
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Baseline GN&C computer sizing estimates are based on well 


understood requirements from previous programs, are therefore relatively 
accurate, and are not expected to grow beyond the 100-percent reserve 
provided. If added functions during the definition phase cause growth 
beyond the reserve, available access channels will accommodate mass 
.memory.. .The ..performance monitor (PM) and .payload .(P.L) functions are 
not as well defined, and the use of tape mass memory allows expansion 
and the sharing of functions to minimize the number of computers. 

Tape memory was selected for the modular display electronics functions, 
which are not time critical, based on availability and low power, 
weight, and cost. The payload data processing requirement of 10,000 
32-bit words is satisfied by the use of a modular display electronics 
unit with an equivalent of 8000 32-bit words in the main memory and the 
tape mass memory. (Preliminary analysis indicates a 4000-word resident 
memory augmented with incremental 2000pword tape loads is adequate.) 

Hardware floaring point arithmetic is implemented in the 
GN&C computer to reduce the problem of scaling errors and provide the 
lowest program cost for the primarily arithmetic GN&C software. Hard- 
ware floating point is not provided in the modular display electonics; 

... i 

the added cost to provide this capability for the primarily data | 

handling and logic functions of the modular display electronics, which | 
do not involve a large amount of scaling, is not justified by off- 
setting software savings. , 
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Table 4.18 .4- 2 illustrates the assignment of pro- 
grams and. requirements to the functionally dedicated 
GN&C computers and MDEs and identifies the mem- 
ory size, speed estimates, and capabilities. These values 
were derived by analyses of vehicle requirements, 
modeling, and coding of selected functions. The results 
of this process compared within 5 percent with equiva- 
lent programs from Apollo RTCC and Saturn IU. 


Table 4.18.4-2 

Program Functional Requirements and Memory Estimates 


j Gtiac 



PM and Backup GliiC MOE's ' 


HIM and PLH MDE s ' ~l 

| -Function 

Sire and 

(Speed! 


Si ?2 and (Speed) 


Size an 

i (Speed' 

r»'yp 

1.1 U.« v> 

/* •-.r 


PM 

BU GNiC 

• rUliClIOil 

PLM 

PLU 

recutive 

3S50 

3:0 

Executive 

• 4 CO 

-100 

Executive 

900 

909 

Data pool, subroutines, 

(13.8! 

(0.5) 

Subroutines, input/output, 

t0.5) 

(5.0) 

Subroutines, input/'output, 

(2.5) 

(2.5) 

input/out. sequencing, 



data pool, tables 



data pool, tables 



scheduling, tables 



System status 

900 


System status 

*2CG0 

1400- 

System status 

2200 

* 

Ncn-Gi<SC system perform- 

(20.0) 


Performance monitor, analog, 



Redundancy management. 

(25.5) 


ance monitor, annunciator 



discrete, serial limit checks 



GlISC. system pcricrmarce 



lights, seif-chock- 



Crew displays 

500 

500 

monitor, ground checkout 



Crew station displays 

3900 


Input/output conversions. 

(5.6) 

(5.6) 

Flight crew displays 

450 

3600 

Input/eutcut conversions, 

(5.6) 


formats, tables, display 



GiiiC system status, 

(0.4) 

(5.6) 

formats, tables, display 



services 



procedures 



services, time share Gif&C, 



Payload checkout 

*2GC0 


Navigation 

5850 


PM, and backup GiiSC 



Minimal on-board checkout, 

(3.0) 


State vector, attitude 

(2.1) 


Backup Glide 


2950 

no experiment processing 



reference 



Steer to displays, get-home 


(33.1) 

PLH control program 


10C0 

Guidance 

7500 


guidance and navigation 



Closod-lcop control of 


(36.3) 

Steering commands, engine 

(39.5) 





attitude, rate, and position 



control, abort 






PLH constraint tobies 


1000 

Targeting 

42G0 





Deployment and retrieval 




(19.3) 





trajectories, rayload 



flight control 

2950 





dependent tables 



JVC, RCS, digital outer loop, 

(20.1) 





Program loader 

150 

150 

boost blending 






Tape memory load on request 



Program services 

2700 








Uplink, PCM, preflight, 

(5.0) 








system align and calibration. 









interfaces (booster, payload, 









main engine controller, 









GSE interface) 









Unmanned orbiter 

500 








Sequencing, calculation for 

(2.5) 


Program loader 

150 

150 * 




autonomous flight 



Tape memory load on crew 






Program loader 


100 

request 






Peak memory loading 

30300 

4050 


5350 

3500 


3550 

4950 


028.2) 

(6.1) 

' 

(26.1) 

(3S.1) 


(13.1) 

(44.9) 

Machine capability main 









memory 

6553S 

8192 


. 8192 


8192 


(380.01 

(295.0) 


(235.0) 


(296.0) 

‘ Tape memory j 


kiTfLJ 

256 K 


256 K 


' Note: Sizing is in terms nf equivalent 22-bit iv 
f.5DE computers ere all 16 bits. Floating 
MOE-ntotJiilar display electronics PLM-o 


arcs. Most GNiC computer instructions are 16 bits, 
point data are 22 or 48 bits and other data are 16 or 32 bits. Speed in KADS. 
oylo-od management P;.* — r-ertormance monitor PLH— payload handling 


‘Mutually exclusive, 
tape memory load 


< 

00 I 
00 
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Rationale 
Not applicable . 
Assumptions 
None . 
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